Account & API Keys Management
Understand your merchant business credentials, how to securely hand them over to your technical team, and how to rotate keys directly from the dashboard.
Your three business credentials explained
When your merchant account is created, Hashpay generates three distinct credentials. Understanding the role and security level of each credential is essential for keeping your store funds secure:
| Credential | Where to Find | Usage & Security Classification |
|---|---|---|
| Merchant ID (Public Key) | Settings → API Keys | Your unique store identifier (e.g. 10001). Completely safe to share with customers, display on invoice receipts, or include in public website source code. |
| API Secret Key | Settings → API Keys | Confidential authentication key. Used exclusively by your backend server or software developer to create automated payment orders. Never reveal this publicly or commit it to GitHub. |
| Webhook Signing Secret | Settings → API Keys & Webhooks | Used by your server developer to mathematically verify that incoming payment notification webhooks genuinely originate from Hashpay, preventing spoofing. |
SOP: Safely sharing credentials with IT developers
When hiring a web agency or working with internal programmers to integrate Hashpay into your website, follow this standard operating procedure (SOP) to prevent credential leaks:
- Retrieve the Secret Key — Log in to your merchant dashboard, navigate to Settings → API Keys, and click the Copy button next to your API Secret Key.
- Transmit via Encrypted Channel — Never send secret keys over unencrypted WhatsApp chats, Telegram groups, or plain emails. Use password-protected secret sharing tools (such as Bitwarden Send, 1Password, or an encrypted password manager).
- Configure Notification Webhook URL — Ask your programmer to provide your store's secure notification callback URL (e.g.,
https://mystore.com/api/hashpay-webhook). Paste this URL into the Webhook URL field under Settings → API Keys & Webhooks. - Test the Integration — Click the Test Webhook button in your dashboard to send a simulated test ping to your programmer's server and verify that the connection works smoothly.
When and how to rotate your API keys
Key rotation is a fundamental security practice that issues a brand-new secret key while instantly deactivating the old one. We strongly advise rotating your keys in any of the following scenarios:
- An external IT agency, freelance developer, or technical employee who previously had access to your credentials finishes their contract or leaves your company.
- A secret key is accidentally pasted into a public communication channel, email thread, or committed to a public code repository (such as GitHub).
- Routine organizational security audits (we recommend rotating operational keys every 90 to 180 days).
To rotate your key, open Settings → API Keys and click Regenerate Key. A confirmation dialog will appear. Once confirmed, your new key is generated immediately.
Account security best practices
- Enable Two-Factor Authentication (2FA) — Safeguard your dashboard login with Google Authenticator or Authy. 2FA is strongly enforced when performing sensitive actions such as bank withdrawals or key rotations.
- Enforce Cashier Isolation — Never give your main owner dashboard credentials to store cashiers. Instead, use the Point of Sale menu to create separate cashier profiles with zero withdrawal access.
- Regular Audit Checks — Review transaction ledgers and bank withdrawal records weekly in your dashboard to ensure all settled amounts reconcile with physical store receipts.