Skip to main content
API keys are how your application authenticates with the IteraPay API. Every request you make on behalf of your merchant account must include an active API key in the Authorization header. This page walks you through generating a key, checking its status, and revoking it when needed.
API keys are scoped to a single merchant. Each merchant account can have only one active API key at a time. If you generate a new key, the previous key is immediately invalidated.

​
Generating an API key

To start accepting payments, you need to generate an API key for your merchant account. You must authenticate this request with your Bearer token (JWT), which you receive when you log in.
1

Authenticate with your Bearer token

Make sure you have a valid JWT from your IteraPay login session. You’ll include this in the Authorization header as Bearer <your-jwt>.
2

Call the generate endpoint

Send a POST request to /key/generate/{merchantID}, replacing {merchantID} with your merchant ID.
generate-api-key.sh
3

Store the returned key securely

The response contains your API key value. Copy it immediately and store it in a secure secrets manager or environment variable — IteraPay does not display the full key again after this point.
response
Generating a new API key immediately revokes the previous key. Any running integrations using the old key will begin receiving authentication errors. Rotate keys during a maintenance window or update your application before generating a replacement.

​
Viewing key information

You can retrieve metadata about your current API key — such as when it was created and when it was last used — without exposing the key value itself. Use this to audit key activity or verify a key exists.
get-key-info.sh
The response includes fields like createdAt and lastUsedAt:
response
If you notice a lastUsedAt timestamp from a time when you didn’t make any requests, your key may be compromised. Revoke it immediately and generate a new one.

​
Using your API key in requests

Once you have an API key, include it in the X-Api-Key header on every API request:
authenticated-request.sh
Store your API key in an environment variable (e.g., ITERAPAY_API_KEY) rather than hardcoding it in your application. This makes key rotation easier and avoids accidental exposure in version control.

​
Revoking an API key

Revoke your API key when you suspect it has been compromised, when offboarding a system that uses it, or as part of a planned key rotation. Once revoked, all requests using that key will fail until you generate a new one.
revoke-api-key.sh
A successful revocation returns 204 No Content with an empty response body. After revoking, you can immediately generate a new key using the generate endpoint described above.

​
Request and response reference

​
POST /key/generate/{merchantID}

​
string
required
Your unique merchant identifier.
​
string
required
Bearer JWT token from your login session. Format: Bearer <token>.
Response
​
string
required
The newly generated API key. Store this value securely — it is not retrievable after this response.

​
GET /key/info/{merchantID}

​
string
required
Your unique merchant identifier.
​
string
required
Bearer JWT token. Format: Bearer <token>.
Response
​
string
ISO 8601 timestamp of when the current key was generated.
​
string
ISO 8601 timestamp of the most recent authenticated request using this key.

​
DELETE /key/revoke/{merchantID}

​
string
required
Your unique merchant identifier.
​
string
required
Bearer JWT token. Format: Bearer <token>.
Returns 204 No Content on success.