Skip to main content
To start making API requests, generate and activate an API key. API keys are tied to your merchant account, not to a specific portal user.

​
Generate a Master key

Use a Master key for integrations that require full API access. By default, a Master key can also create withdrawals. If your integration must not be able to create withdrawals, turn off Allow withdrawals in step 3.
Only one Master key can be active at a time.
1

In your portal, go to the API keys tab.

2

Click Generate API key and enter a unique name for the key.

The name can contain up to 50 characters.
3

Under Key type, select Master and choose whether to allow withdrawals.

Allow withdrawals is turned on by default. It controls all three withdrawal endpoints:If you turn it off, requests to these endpoints made with this key are rejected. You can change this setting later by editing the key.
4

Click Next step and optionally specify allowed IP addresses.

Use either IPv4 or IPv6 format, and separate multiple IP addresses with commas. If you leave this blank, requests from any IP address will be accepted.
5

Click Proceed, enter your 2FA code, and click Generate.

The key is added to the list with the New status.
6

Click Activate next to the API key, enter your 2FA code, and confirm the activation.

Activate is unavailable while another Master key is active. Deactivate the active Master key first.
Your secret key will be displayed after you click Activate. Make sure no one can see or record your screen.
7

Save your secret key and click Done.

Your secret key is displayed only once. Toggle Secret key QR code to display the secret key as a QR code.

Do not share your secret key with anyone.

If you think your secret key may have been compromised, archive the API key immediately and contact our Support team.

​
Generate a Custom key for read-only reporting

Use a Custom key for integrations that need access to specific functionality only, for example a reporting tool that reads balances and transactions. Multiple Custom keys can be active at the same time, alongside the active Master key.
1

In your portal, go to the API keys tab.

2

Click Generate API key and enter a unique name for the key.

The name can contain up to 50 characters.
3

Under Key type, select Custom and choose the abilities.

Under Allowed functionality, select at least one ability the key may call:For a reporting tool, select Balances and Transaction info.
4

Click Next step and optionally specify allowed IP addresses.

Use either IPv4 or IPv6 format, and separate multiple IP addresses with commas. If you leave this blank, requests from any IP address will be accepted.
5

Click Proceed, enter your 2FA code, and click Generate.

The key is added to the list with the New status.
6

Click Activate next to the API key, enter your 2FA code, and confirm the activation.

Your secret key will be displayed after you click Activate. Make sure no one can see or record your screen.
7

Save your secret key and click Done.

Your secret key is displayed only once. Toggle Secret key QR code to display the secret key as a QR code.

Do not share your secret key with anyone.

If you think your secret key may have been compromised, archive the API key immediately and contact our Support team.

​
FAQ

​
What’s the difference between the API key and the secret key?

  • API key - Specified in the X-Processing-Key header in API requests. You can view it in the API keys section of your portal.
  • Secret key - Used to generate an HMAC-SHA512 signature of the request body. The signature is specified in the X-Processing-Signature header in API requests. You can view the secret key only once, after activating the API key for the first time.

​
How can I view my secret key if I lost it?

If you don’t have your secret key, archive the corresponding API key, then generate and activate a replacement.

​
What should I do if someone else got access to my secret key?

If you suspect that your secret key was compromised, archive the API key immediately and contact our Support team. Archived API keys cannot be reactivated.

​
How do I disable withdrawals for an API key?

Withdrawals are controlled by the Allow withdrawals setting, which is available for Master keys. To turn it off for an existing key, edit the key and turn off Allow withdrawals. Requests to the three withdrawal endpoints made with that key are then rejected.

​
How do I manage allowed IP addresses for API requests?

You can update the IP addresses a key accepts requests from at any time. See Edit the IP whitelist.
Last modified on September 18, 2026