> ## Documentation Index
> Fetch the complete documentation index at: https://developers.uqpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> The merchant dashboard Developers > API Keys page — view, search, create, edit, and delete API keys used for programmatic API access, and set a name, IP allow list, and scope permissions for each key.

## What this is

This is the **API Keys** page under the **Developers** module in the merchant dashboard (left nav **Developers** → **API Keys**; page subtitle "Manage API keys for programmatic access"). API keys let your systems call UQPAY APIs programmatically. Here you can view all keys on your account, filter by name or status, create new keys, edit existing keys (name, IP allow list, scope permissions), and delete keys. Use this page whenever you need to integrate with the API, manage calling credentials, or restrict a key's source IP or permissions. The top right of the page has a **Documents** link to the API key setup guide.

## Steps

Open and view the key list:

1. In the left nav, click **Developers** → **API Keys**.
2. The list shows every key on your account. Use the **API key name** search box to find a key by name, and **Filter by status** to narrow by status (All Status / Enabled / Disabled). Applied filters appear as tags in a **Filtered by** row; click the "x" on a tag to remove it, or **Clear all** to reset.

Create a new key: click **Create API Key** at the top right to start the creation flow — enter a key name and IP allow list, select scope permissions, then submit to reveal the secret key once. Full steps are in the **create API key** page.

Edit a key:

1. At the end of the target key's row, open the **⋯** menu → **Edit API Key** to open the full-screen edit page.
2. The read-only **Client ID** is shown on the left; you can change **Key Name** and **IP Allow List**. The **Scope permissions** matrix on the right lets you check/uncheck read and write access for this key.
3. Click **Save Changes** at the bottom right. Editing **does not** rotate the secret key (it stays the same).

Delete a key:

1. Open the target key's **⋯** menu → **Delete API Key**.
2. Confirm in the dialog (shows the key name and "This action cannot be undone."), then click **Delete** to confirm.

Copy the client ID: there's a copy button next to the **Client ID** column in the list; click it to copy the full ID.

## Fields and statuses

**List columns:**

| Column        | Meaning (merchant view)                                                                                                                              | Notes                                             |
| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| Name          | The name given to the key at creation                                                                                                                |                                                   |
| Client ID     | The key's public identifier (Client ID), used when calling the API                                                                                   | Has a copy button inline                          |
| IP Allow List | Source IPs allowed to call the API with this key; when there are multiple, the list shows the first and collapses the rest as "+N", hover to see all | Empty shows "—", meaning no source IP restriction |
| Status        | The key's current status, see below                                                                                                                  |                                                   |
| Created       | Date and time the key was created                                                                                                                    |                                                   |
| Last Updated  | Last time the key was modified                                                                                                                       |                                                   |

**Status:**

| Status   | Meaning                                                  |
| -------- | -------------------------------------------------------- |
| Enabled  | The key is valid and can call the API normally           |
| Disabled | The key is deactivated and cannot currently call the API |

**IP Allow List**: accepts IPv4 or IPv6 addresses, including CIDR ranges (e.g. `10.0.0.0/24`, `2001:db8::/32`). Press Enter or comma to add an entry; you can add multiple. Leave it empty for no source IP restriction. If you enter an open range meaning "any IP" (`0.0.0.0/0` or `::/0`), the page warns that this key will accept calls from any IP — recommended only for short-term testing; for production, narrow it to your server IPs.

**Scope permissions**: each key can be granted permissions by resource, each with **Read** and **Write** actions that can be checked individually, or in bulk per resource or per column (Read all / Write all). Checking Write automatically checks the corresponding Read. **At least one permission must be selected** at creation or edit time, or the form cannot be submitted. A key can only call APIs within its granted scope.

**Client ID vs. secret key**: the client ID is a public identifier, always visible and copyable in the list; the **secret key (the key itself) is shown only once, at creation**. Once the dialog is closed it cannot be viewed again, so save it securely at that moment. Treat the secret like a password — store it in a secrets manager, never commit it to source control — and if it's ever exposed, delete the key immediately and create a new one.

## Edge cases and troubleshooting

* **No "Create API Key" button visible**: either your account lacks write permission for developer keys (ask an admin to grant it), or your account hasn't enabled API access yet (contact your admin or account manager to activate it, after which the entry point appears).
* **No "⋯" menu at the end of a row (can't edit/delete)**: your account only has read access to API keys; ask an admin to grant write permission.
* **List shows "No API keys yet"**: no keys have been created yet; the hint reads "Create your first API key to get started." — click **Create API Key** to add one.
* **Filtered list shows "No API keys match your filters"**: your current search/status filter has no matches; click **Clear filters** or **Clear all** and try again.
* **Forgot to save the secret key / lost it**: the secret is shown only once at creation and cannot be recovered; delete the key and create a new one.
* **Prompted to re-verify identity while creating or editing**: creating or editing keys is a sensitive action, so the system may prompt for two-factor verification (account password / authenticator code, etc.); the change takes effect once you pass it.
* **Want to restrict a key to a fixed IP**: edit the key and enter the allowed server IP(s) (CIDR supported) in **IP Allow List**, then save.
* **Changed the name/IP/permissions but the secret stayed the same**: editing never rotates the secret; only deleting and recreating the key produces a new secret.

## Common questions (Q\&A)

* **Q: Where do I manage / view API keys?** A: Left nav **Developers** → **API Keys**; the list shows every key on your account.
* **Q: How do I create an API key?** A: On the API Keys page, click **Create API Key** at the top right, fill in the name and IP allow list, select scope permissions, then submit. The system shows the secret key once — see the create API key page for full steps.
* **Q: Why don't I see the "Create API Key" button?** A: Usually a missing write permission for developer keys, or the account hasn't activated API access yet — ask an admin to grant permission, or contact your admin/account manager to activate API access.
* **Q: I forgot to save the secret key — can I view it again?** A: No. The secret is shown only once at creation and can't be recovered afterward; delete the key and create a new one.
* **Q: What's the difference between Client ID and the secret key?** A: The Client ID is a public identifier, always visible and copyable in the list; the secret key is the calling credential, shown only once at creation — save it immediately and keep it secure.
* **Q: How do I restrict a key to only call from our server IP?** A: Edit the key and enter the allowed IP(s) (CIDR supported) in IP Allow List, then save; leaving it empty means no source IP restriction.
* **Q: What does entering 0.0.0.0/0 in the IP allow list mean?** A: It allows any IP to use the key — higher risk, recommended only for short-term testing; for production, narrow it to your server IPs.
* **Q: What is scope permissions / how do I control which APIs a key can call?** A: In the Scope permissions matrix, check Read/Write per resource when creating or editing; the key can only call APIs within its granted scope, and at least one permission must be selected.
* **Q: How do I edit a key? Does renaming it rotate the secret?** A: Open the key's "⋯" menu and choose **Edit API Key** to change name, IP allow list, or scope permissions; editing never rotates the secret.
* **Q: How do I delete / disable a key?** A: Open the key's "⋯" menu, choose **Delete API Key**, and confirm — deletion cannot be undone.
* **Q: What do the "Enabled" and "Disabled" statuses mean?** A: Enabled means the key is valid and can call the API; Disabled means it's deactivated and can't currently call the API.
* **Q: Why am I asked to re-enter my password / a code when creating a key?** A: This is two-factor verification for a sensitive action — enter it to continue.
* **Q: What should I do if a key is exposed?** A: Delete the key from the list immediately, create a new one, and update the credential used in your systems.