Scheduled maintenanceScheduled maintenance: PayWise infrastructure maintenance is planned from Friday, October 9 at 7:00 p.m. ET through Monday, October 12 at 8:00 a.m. ET. Sandbox and Production services may experience intermittent interruptions during this period. Existing PayWise service URLs and SFTP hostnames will remain unchanged.
Skip to main content

API Keys & Access

API Keys & Access​

Sandbox keys are managed in Sandbox Console after Identity sign-in. Production dashboard access and production key issuance are provisioned separately after approval.

Key model​

  • Separate keys by environment and workload.
  • Apply least-privilege route scope.
  • Rotate on a fixed cadence and on incident response.

Storage requirements​

  • Store keys only in a secrets manager.
  • Never commit keys to source control.
  • Use short-lived deployment injection where possible.

Rotation workflow​

  1. Create new key.
  2. Deploy dual-key capable config.
  3. Shift traffic to new key.
  4. Revoke old key and validate no residual usage.
Deprecated

Long-lived shared keys across multiple systems are deprecated practice. Move to per-service scoped credentials.