Skip to main content

Account and API Key(s) Management Guide

Objective​

The following guide is an introduction on how you and Payments AI admins create/manage accounts and API keys.

Account​

In the first step when you are integrating with Payments AI admins will create an account for you and share with you the temporal API key.

  • You are not able to use the Payments AI till you activate the account
  • With the temporal API key you are not able to make payments, so your account is secure

After the account has been created, activate it by providing a secret using the temporal API key. The temporal API key is valid for 7 days — if you do not use it within that window, the key expires and Payments AI must issue a new one.

  • After the account has been activated your API key will be rotated
  • With this new API key you will be able to use the Payments AI to the full extent

You can activate the account thanks to a request similar to this one:

curl --location --request PATCH 'https://staging-api.payments.ai/v1/accounts/public-api/${ACCOUNT_ID}' \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --header 'Authorization: ApiKey ${TEMPORAL_API_KEY}' \
    --data '{
        "secret": "${SECRET}"
    }'

After the account has been activated you will receive API key in the response. You do not need to rotate it.

Api Key​

You can secure a single account with a secret and then create multiple API keys for various purposes as needed. Our API provides endpoints that allow you to:

  • Retrieve data when the API key has been rotated
curl --location --request PUT 'https://staging-api.payments.ai/v1/accounts/public-api/${ACCOUNT_ID}/api-keys' \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --header 'Authorization: ApiKey ${TEMPORAL_API_KEY}' \
    --data '{
        "secret": "${SECRET}"
    }'
  • Rotate your API key
curl --location --request PATCH 'https://staging-api.payments.ai/v1/accounts/public-api/${ACCOUNT_ID}/api-keys/${API_KEY_ID}' \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --header 'Authorization: ApiKey ${TEMPORAL_API_KEY}' \
    --data '{
        "secret": "${SECRET}"
    }'

All of these activities are paired with the secret and API key of the account.

Payments AI admins​

We will monitor the activity related to each account.

  • If the account is compromised you could ask us to deactivate the account
  • We could also revoke and rotate your API keys if necessary

Secrets Policy​

Secrets need to have:

  • at least 12 characters
  • one upper letter
  • at least one alphanumeric

Secret will need to be changed every 90 days. The new secret will need to be different from the last 4 ones. You need to follow this policy only if you wish to create/rotate your API keys.