> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cryptoprocessing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate and activate API keys

export function Available({to, except}) {
  const roles = <Tooltip tip="Roles determine what each user can see and do in the portal." cta="See role descriptions" href="/merchant-administration/add-a-user#determine-which-role-to-use">roles</Tooltip>;
  if (to) {
    return <><strong>Available to {roles}:</strong> {to.map(role => <>{" "}<Badge color="blue">{role}</Badge></>)}</>;
  } else {
    return <><strong>Available to all {roles} except</strong> {except.map(role => <>{" "}<Badge color="blue">{role}</Badge></>)}</>;
  }
}

<Available to={["Owner"]} />

To start making API requests, generate and activate an API key. API keys are tied to your merchant account, not to a specific portal user.

## Generate a Master key

Use a Master key for integrations that require full API access. By default, a Master key can also create withdrawals. If your integration must not be able to create withdrawals, turn off **Allow withdrawals** in step 3.

<Note>
  Only one Master key can be active at a time.
</Note>

<Steps>
  <Step title="In your portal, go to the API keys tab." />

  <Step title="Click Generate API key and enter a unique name for the key.">
    The name can contain up to 50 characters.
  </Step>

  <Step title="Under Key type, select Master and choose whether to allow withdrawals.">
    **Allow withdrawals** is turned on by default. It controls all three withdrawal endpoints:

    * [/v2/withdrawal/crypto](/api-reference/endpoints/withdrawal-crypto)
    * [/v2/crypto/withdrawal\_instant](/api-reference/endpoints/crypto-withdrawal-instant)
    * [/v2/crypto/withdrawal\_instant\_exchange](/api-reference/endpoints/crypto-withdrawal-instant-exchange)

    If you turn it off, requests to these endpoints made with this key are rejected. You can change this setting later by [editing the key](/merchant-administration/manage-api-keys#change-the-name-or-permissions-of-an-api-key).
  </Step>

  <Step title="Click Next step and optionally specify allowed IP addresses.">
    Use either IPv4 or IPv6 format, and separate multiple IP addresses with commas. If you leave this blank, requests from any IP address will be accepted.
  </Step>

  <Step title="Click Proceed, enter your 2FA code, and click Generate.">
    The key is added to the list with the **New** status.
  </Step>

  <Step title="Click Activate next to the API key, enter your 2FA code, and confirm the activation.">
    **Activate** is unavailable while another Master key is active. [Deactivate](/merchant-administration/manage-api-keys#deactivate-an-api-key) the active Master key first.

    <Warning>
      Your secret key will be displayed after you click **Activate**. Make sure no one can see or record your screen.
    </Warning>
  </Step>

  <Step title="Save your secret key and click Done.">
    Your secret key is displayed only once. Toggle **Secret key QR code** to display the secret key as a QR code.

    <Card title="Do not share your secret key with anyone. " type="danger">
      If you think your secret key may have been compromised, [archive the API key](/merchant-administration/manage-api-keys#archive-an-api-key) immediately and contact our Support team.
    </Card>
  </Step>
</Steps>

## Generate a Custom key for read-only reporting

Use a Custom key for integrations that need access to specific functionality only, for example a reporting tool that reads balances and transactions. Multiple Custom keys can be active at the same time, alongside the active Master key.

<Steps>
  <Step title="In your portal, go to the API keys tab." />

  <Step title="Click Generate API key and enter a unique name for the key.">
    The name can contain up to 50 characters.
  </Step>

  <Step title="Under Key type, select Custom and choose the abilities.">
    Under **Allowed functionality**, select at least one ability the key may call:

    * **Balances** - [/v2/accounts/list](/api-reference/endpoints/accounts-list)
    * **Transaction info** - [/v2/transactions/info](/api-reference/endpoints/transactions-info)
    * **Currency rates** - [/v2/currencies/rates](/api-reference/endpoints/currencies-rates)
    * **Currencies list** - [/v2/currencies/list](/api-reference/endpoints/currencies-list)

    For a reporting tool, select **Balances** and **Transaction info**.
  </Step>

  <Step title="Click Next step and optionally specify allowed IP addresses.">
    Use either IPv4 or IPv6 format, and separate multiple IP addresses with commas. If you leave this blank, requests from any IP address will be accepted.
  </Step>

  <Step title="Click Proceed, enter your 2FA code, and click Generate.">
    The key is added to the list with the **New** status.
  </Step>

  <Step title="Click Activate next to the API key, enter your 2FA code, and confirm the activation.">
    <Warning>
      Your secret key will be displayed after you click **Activate**. Make sure no one can see or record your screen.
    </Warning>
  </Step>

  <Step title="Save your secret key and click Done.">
    Your secret key is displayed only once. Toggle **Secret key QR code** to display the secret key as a QR code.

    <Card title="Do not share your secret key with anyone. " type="danger">
      If you think your secret key may have been compromised, [archive the API key](/merchant-administration/manage-api-keys#archive-an-api-key) immediately and contact our Support team.
    </Card>
  </Step>
</Steps>

## FAQ

### What's the difference between the API key and the secret key?

* **API key** - Specified in the `X-Processing-Key` header in API requests. You can view it in the **API keys** section of your portal.
* **Secret key** - Used to generate an HMAC-SHA512 signature of the request body. The signature is specified in the `X-Processing-Signature` header in API requests. You can view the secret key only once, after activating the API key for the first time.

### How can I view my secret key if I lost it?

If you don't have your secret key, [archive](/merchant-administration/manage-api-keys#archive-an-api-key) the corresponding API key, then generate and activate a replacement.

### What should I do if someone else got access to my secret key?

If you suspect that your secret key was compromised, [archive the API key](/merchant-administration/manage-api-keys#archive-an-api-key) immediately and contact our Support team. Archived API keys cannot be reactivated.

### How do I disable withdrawals for an API key?

Withdrawals are controlled by the **Allow withdrawals** setting, which is available for Master keys. To turn it off for an existing key, [edit the key](/merchant-administration/manage-api-keys#change-the-name-or-permissions-of-an-api-key) and turn off **Allow withdrawals**. Requests to the three withdrawal endpoints made with that key are then rejected.

### How do I manage allowed IP addresses for API requests?

You can update the IP addresses a key accepts requests from at any time. See [Edit the IP whitelist](/merchant-administration/manage-api-keys#edit-the-ip-whitelist).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.