> ## Documentation Index
> Fetch the complete documentation index at: https://ownpay.org/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> OwnPay is licensed under AGPL-3.0 and is completely free - no licensing fees.
> Production docs URL: https://ownpay.org/docs - append .md to any page URL for clean markdown.
> OwnPay requires PHP 8.3+, MySQL/MariaDB, and Redis.
> MCP server available at https://ownpay.org/docs/mcp for programmatic documentation queries.
> Use root-relative links (e.g. /quickstart) for internal navigation - do NOT include /docs prefix.
> Plugin development: consult /developer/plugins/ pages for correct interfaces and manifests.
> Canonical locations: API auth = /api/authentication, webhook verification = /api/webhooks, rate limits = /resources/rate-limiting, transaction statuses = /fundamentals/payment-flow.
> The documentation uses the Diataxis framework: Tutorials (learning), How-to (tasks), Reference (lookup), Explanation (understanding).

# API Keys

> Generate, scope, and manage API keys for programmatic access to the OwnPay Admin API, Merchant API, and Mobile API.

API keys let you authenticate programmatic requests to OwnPay's three API layers without going through the browser login flow. Each key has defined scopes that limit what it can access.

<Info>
  For the full authentication mechanism including signature generation, see [API Authentication](/docs/api/authentication).
</Info>

## Generate an API key

<Steps>
  <Step>
    Navigate to **Developer Hub > API Keys** in the left sidebar.
  </Step>

  <Step>
    Click **Generate New Key**.
  </Step>

  <Step>
    Select the **API layer** this key will access: Admin API, Merchant API, or Mobile API.
  </Step>

  <Step>
    Choose one or more **scopes**:

    | Scope   | Permission                                     |
    | ------- | ---------------------------------------------- |
    | `read`  | View resources (transactions, customers, etc.) |
    | `write` | Create and modify resources                    |
    | `admin` | Full access including system configuration     |
  </Step>

  <Step>
    Optionally add a **label** (for example, "WooCommerce Integration") for identification.
  </Step>

  <Step>
    Click **Create**. The full key is displayed once. Copy it immediately - it will not be shown again.
  </Step>
</Steps>

<Warning>
  Treat API keys like passwords. Never commit them to source code, log files, or public repositories. Use environment variables or a secrets manager instead.
</Warning>

## Key metadata

Each API key in the list shows:

| Column        | Description                              |
| ------------- | ---------------------------------------- |
| **Label**     | The human-readable name you assigned     |
| **API Layer** | Admin, Merchant, or Mobile               |
| **Scopes**    | The permissions granted to this key      |
| **Last Used** | Timestamp of the most recent API request |
| **Last IP**   | IP address of the most recent request    |
| **Actions**   | Revoke                                   |

## Revoke a key

Click **Revoke** on any key row. The key is immediately invalidated - any subsequent API request using that key returns a `401 Unauthorized` response.

<Note>
  Revocation is permanent. Generate a new key if you need to restore access.
</Note>

## Rate limits per key

Each API key is subject to rate limiting. Exceeding the limit returns a `429 Too Many Requests` response with a `Retry-After` header.

| API Layer    | Limit                   |
| ------------ | ----------------------- |
| Admin API    | 120 requests per minute |
| Merchant API | 300 requests per minute |
| Mobile API   | 60 requests per minute  |

<Info>
  For detailed rate limiting behavior and burst allowances, see [Rate Limiting](/docs/resources/rate-limiting).
</Info>

## Super-admin API key generation

Super-admins can generate keys with the `admin` scope, which grants full access to all system configuration, brand management, and user management endpoints. Only generate admin-scoped keys when absolutely necessary - use `read` or `write` scopes for integrations that only need data access or transaction creation.

## Related Pages

* [API Authentication](/docs/api/authentication) - How to use your API key in requests
* [Rate Limiting](/docs/resources/rate-limiting) - Detailed rate limit documentation
* [Developer Hub](/docs/security/developer-hub) - Webhook and logging tools


## Related topics

- [Generate API Key](/docs/api-reference/generate-api-key.md)
- [List API Keys](/docs/api-reference/list-api-keys.md)
- [Revoke API Key](/docs/api-reference/revoke-api-key.md)
- [API Authentication](/docs/api/authentication.md)
- [API Overview](/docs/api/overview.md)