API credentials
Generate and protect merchant credentials without using dashboard session tokens.
Generate credentials in the dashboard
Use the API credentials workflow in the dashboard. Store the returned API key ID and secret immediately; the source describes the secret as shown once. Keep the complete secret, without trimming or copying only a visible portion.
Keep secrets on your backend
Store credentials in a secret manager or server-only environment variables. Restrict access, redact headers in logs and avoid credentials in support tickets. Never embed the secret in browser JavaScript, a public repository or a mobile client.
Choose the correct headers
Merchant HMAC uses X-API-* headers. Plugin APIs use X-ZytePe-* headers. Authentication explains both. Dashboard bearer tokens are session credentials, not a substitute for merchant server authentication.
Credential changes
Coordinate credential regeneration and rollout with your operations team. The supplied contract does not establish overlapping-key support or a rotation grace period; confirm those before changing a live integration.