Skip to main content
API keys let you authenticate programmatic requests to OwnPay’s three API layers without going through the browser login flow. Each key has defined scopes that limit what it can access.
For the full authentication mechanism including signature generation, see API Authentication.

​
Generate an API key

1
Navigate to Developer Hub > API Keys in the left sidebar.
2
Click Generate New Key.
3
Select the API layer this key will access: Admin API, Merchant API, or Mobile API.
4
Choose one or more scopes:
5
Optionally add a label (for example, “WooCommerce Integration”) for identification.
6
Click Create. The full key is displayed once. Copy it immediately - it will not be shown again.
Treat API keys like passwords. Never commit them to source code, log files, or public repositories. Use environment variables or a secrets manager instead.

​
Key metadata

Each API key in the list shows:

​
Revoke a key

Click Revoke on any key row. The key is immediately invalidated - any subsequent API request using that key returns a 401 Unauthorized response.
Revocation is permanent. Generate a new key if you need to restore access.

​
Rate limits per key

Each API key is subject to rate limiting. Exceeding the limit returns a 429 Too Many Requests response with a Retry-After header.
For detailed rate limiting behavior and burst allowances, see Rate Limiting.

​
Super-admin API key generation

Super-admins can generate keys with the admin scope, which grants full access to all system configuration, brand management, and user management endpoints. Only generate admin-scoped keys when absolutely necessary - use read or write scopes for integrations that only need data access or transaction creation.
Last modified on August 25, 2026

Related topics

Generate API KeyList API KeysRevoke API KeyAPI AuthenticationAPI Overview