Skip to main content

​
What this is

This is the API Keys page under the Developers module in the merchant dashboard (left nav Developers → API Keys; page subtitle “Manage API keys for programmatic access”). API keys let your systems call UQPAY APIs programmatically. Here you can view all keys on your account, filter by name or status, create new keys, edit existing keys (name, IP allow list, scope permissions), and delete keys. Use this page whenever you need to integrate with the API, manage calling credentials, or restrict a key’s source IP or permissions. The top right of the page has a Documents link to the API key setup guide.

​
Steps

Open and view the key list:
  1. In the left nav, click Developers → API Keys.
  2. The list shows every key on your account. Use the API key name search box to find a key by name, and Filter by status to narrow by status (All Status / Enabled / Disabled). Applied filters appear as tags in a Filtered by row; click the “x” on a tag to remove it, or Clear all to reset.
Create a new key: click Create API Key at the top right to start the creation flow — enter a key name and IP allow list, select scope permissions, then submit to reveal the secret key once. Full steps are in the create API key page. Edit a key:
  1. At the end of the target key’s row, open the ⋯ menu → Edit API Key to open the full-screen edit page.
  2. The read-only Client ID is shown on the left; you can change Key Name and IP Allow List. The Scope permissions matrix on the right lets you check/uncheck read and write access for this key.
  3. Click Save Changes at the bottom right. Editing does not rotate the secret key (it stays the same).
Delete a key:
  1. Open the target key’s ⋯ menu → Delete API Key.
  2. Confirm in the dialog (shows the key name and “This action cannot be undone.”), then click Delete to confirm.
Copy the client ID: there’s a copy button next to the Client ID column in the list; click it to copy the full ID.

​
Fields and statuses

List columns: Status: IP Allow List: accepts IPv4 or IPv6 addresses, including CIDR ranges (e.g. 10.0.0.0/24, 2001:db8::/32). Press Enter or comma to add an entry; you can add multiple. Leave it empty for no source IP restriction. If you enter an open range meaning “any IP” (0.0.0.0/0 or ::/0), the page warns that this key will accept calls from any IP — recommended only for short-term testing; for production, narrow it to your server IPs. Scope permissions: each key can be granted permissions by resource, each with Read and Write actions that can be checked individually, or in bulk per resource or per column (Read all / Write all). Checking Write automatically checks the corresponding Read. At least one permission must be selected at creation or edit time, or the form cannot be submitted. A key can only call APIs within its granted scope. Client ID vs. secret key: the client ID is a public identifier, always visible and copyable in the list; the secret key (the key itself) is shown only once, at creation. Once the dialog is closed it cannot be viewed again, so save it securely at that moment. Treat the secret like a password — store it in a secrets manager, never commit it to source control — and if it’s ever exposed, delete the key immediately and create a new one.

​
Edge cases and troubleshooting

  • No “Create API Key” button visible: either your account lacks write permission for developer keys (ask an admin to grant it), or your account hasn’t enabled API access yet (contact your admin or account manager to activate it, after which the entry point appears).
  • No ”⋯” menu at the end of a row (can’t edit/delete): your account only has read access to API keys; ask an admin to grant write permission.
  • List shows “No API keys yet”: no keys have been created yet; the hint reads “Create your first API key to get started.” — click Create API Key to add one.
  • Filtered list shows “No API keys match your filters”: your current search/status filter has no matches; click Clear filters or Clear all and try again.
  • Forgot to save the secret key / lost it: the secret is shown only once at creation and cannot be recovered; delete the key and create a new one.
  • Prompted to re-verify identity while creating or editing: creating or editing keys is a sensitive action, so the system may prompt for two-factor verification (account password / authenticator code, etc.); the change takes effect once you pass it.
  • Want to restrict a key to a fixed IP: edit the key and enter the allowed server IP(s) (CIDR supported) in IP Allow List, then save.
  • Changed the name/IP/permissions but the secret stayed the same: editing never rotates the secret; only deleting and recreating the key produces a new secret.

​
Common questions (Q&A)

  • Q: Where do I manage / view API keys? A: Left nav Developers → API Keys; the list shows every key on your account.
  • Q: How do I create an API key? A: On the API Keys page, click Create API Key at the top right, fill in the name and IP allow list, select scope permissions, then submit. The system shows the secret key once — see the create API key page for full steps.
  • Q: Why don’t I see the “Create API Key” button? A: Usually a missing write permission for developer keys, or the account hasn’t activated API access yet — ask an admin to grant permission, or contact your admin/account manager to activate API access.
  • Q: I forgot to save the secret key — can I view it again? A: No. The secret is shown only once at creation and can’t be recovered afterward; delete the key and create a new one.
  • Q: What’s the difference between Client ID and the secret key? A: The Client ID is a public identifier, always visible and copyable in the list; the secret key is the calling credential, shown only once at creation — save it immediately and keep it secure.
  • Q: How do I restrict a key to only call from our server IP? A: Edit the key and enter the allowed IP(s) (CIDR supported) in IP Allow List, then save; leaving it empty means no source IP restriction.
  • Q: What does entering 0.0.0.0/0 in the IP allow list mean? A: It allows any IP to use the key — higher risk, recommended only for short-term testing; for production, narrow it to your server IPs.
  • Q: What is scope permissions / how do I control which APIs a key can call? A: In the Scope permissions matrix, check Read/Write per resource when creating or editing; the key can only call APIs within its granted scope, and at least one permission must be selected.
  • Q: How do I edit a key? Does renaming it rotate the secret? A: Open the key’s ”⋯” menu and choose Edit API Key to change name, IP allow list, or scope permissions; editing never rotates the secret.
  • Q: How do I delete / disable a key? A: Open the key’s ”⋯” menu, choose Delete API Key, and confirm — deletion cannot be undone.
  • Q: What do the “Enabled” and “Disabled” statuses mean? A: Enabled means the key is valid and can call the API; Disabled means it’s deactivated and can’t currently call the API.
  • Q: Why am I asked to re-enter my password / a code when creating a key? A: This is two-factor verification for a sensitive action — enter it to continue.
  • Q: What should I do if a key is exposed? A: Delete the key from the list immediately, create a new one, and update the credential used in your systems.