Skip to content
ROTTA PAYdocs
IntegrationManual
PTEN
Go to dashboard

API Keys

An API key authenticates the calls your system's server makes to Rotta Pay. In the menu, open Integrations → API Keys. You can also get there from Settings → Integrations → Manage keys.

The key text is shown only once, when it is issued. Store it right away. To use the key in your calls, see API Keys in the integration docs.

#Who can make changes

Anyone on the team sees the list of keys, showing only the start of each one. Issuing, rotating and revoking keys, and changing the allowed IP list, is only for people with the Owner or Administrator role (see Team). For other roles, the screen hides the buttons and says who can do it.

#Issue a key

  1. Click Issue key.
  2. In Label (optional), give the key a name you will recognize, for example the system that will use it. The label is shown only in the dashboard.
  3. Check Issue as test key if the key is for testing. Without it, the key is a live key.
  4. Click Issue key.

#Save the key

The Save your API key now window shows the Key, the Fingerprint and the Label, with the Test or Live badge.

  1. Click Copy and store the key somewhere safe.
  2. Click I've saved it.

The window does not close with Esc or with a click outside it, only with I've saved it or the X. Once it closes, the key is not shown again: only the fingerprint is kept. If you lost the key, rotate it or issue another one.

#Active keys

The Active keys list shows the start of each key, the Test or Live badge, the label and the date in Created. With no keys, it shows "No keys yet. Issue your first key to start integrating."

#Rotate a key

Rotate revokes the current key immediately and issues a new one of the same kind: a test key stays a test key, a live key stays a live key.

The confirmation tells you the effect: until you put the new key on your server, API calls, including charges and payouts, are rejected. To go ahead, click Rotate and revoke the current key. The new key shows up in the same save window.

#Revoke a key

Revoke turns the key off. Any integration using that key loses access immediately, and it cannot be undone. Confirm with Revoke.

#Allowed IPs

The Allowed IPs (API) card is an extra protection on top of the key. With an empty list, there is no restriction. With at least one IP on the list, the API only accepts calls from those IPs, including payouts.

It accepts an IPv4 or IPv6 address or a CIDR range, such as 203.0.113.10 or 203.0.113.0/24.

To add an IP:

  1. Type the address in IP or CIDR.
  2. If you want, fill in Description (optional), for example the server name.
  3. Click Add.

The first IP turns the lock on. The screen asks you to confirm with Turn on the lock, because from then on calls from any other IP are rejected.

Remove takes an IP off the list: charges and payouts coming from it are rejected immediately. Removing the last IP turns the lock off (Remove and turn off the lock), and the API accepts calls from any IP with a valid key again.

The screen shows Your current IP (this browser). Note: the API is called by your system's server, not by your browser. Add the server's IP.