FAQ

Each answer here is deliberately short. The guide it links to is the source of truth - if the two ever disagree, trust the guide and tell us. For something not covered, see Support.

Credentials #

I revoked my key and generated a new one, but only saved the secret key. What now? #

You cannot recover the secret key - it is shown once (the raw API key can be read back from GET /integrators/{id}/apikeys, but it cannot sign without the secret key). Issue another key, store all three values it returns (apiKey, secretKey, publicKey), then revoke the incomplete one. See If you lose a credential.

Can I get my public key back? #

Yes. GET /integrators/{id}/apikeys returns the public key and the raw API key of every key in full. Only the secret key is masked there.

I revoked my only key. How do I issue a new one? #

Sign in to the dashboard as your Integrator's owner or an active member and issue it from there - a dashboard session does not need a working key. See If you lose a credential.

Does issuing a new key revoke the old one? #

No. Keys are additive, so rotation needs no downtime. Revoke the old key yourself once traffic on it stops. See Rotating a key.

I lost my webhook signing secret. #

It cannot be shown again. Ask us for a new one - see Asking for a change.

Signing requests #

Every request returns 401 Signature verification failed. #

The usual causes are signing the public key instead of the raw API key, or using different timestamps in the header and in the signed message. See When the signature does not match.

Why does a key with only the secret key not work? #

The signature is an HMAC of "<rawApiKey>:<timestamp>" keyed with the secret key, so it needs both. See Your three credentials.

Payments #

A payment is stuck in PENDING. #

Reconcile it before escalating, and do not resubmit it. See Escalating a stuck payment.

Webhooks #

The same webhook arrived twice. #

That is by design - delivery is at-least-once. Dedupe on eventId. See Retries and delivery.