Glossary
API key
An API key is the secret a merchant's server presents with every request to the platform's API to prove it is that merchant: a long random string issued in the merchant's cabinet, often as a pair of a public identifier and a private secret used to sign requests. It is a credential like a password with no person behind it, so it must be stored in a secrets store, never in code or a browser, rotated when people leave or systems change, and revoked at once when exposed.
Scopes and limits
Separate keys for test and live; keys limited to operations, so a key that creates payments cannot send payouts; restrictions to the merchant’s server addresses; and signatures over the request body with the secret, so that a captured request cannot be replayed or altered. Webhooks are signed the other way, with a key the merchant can verify.
What a leaked key can do
Create payments and, worse, payouts in the merchant’s name, read payment data and change webhook endpoints. The damage is bounded by scopes, limits and monitoring: a payout key with a daily limit and an address restriction leaks much less than an all-powerful one.
On the platform
In Tranzify each merchant has its own keys issued in the cabinet of its network, with live and test keys apart; requests are checked against the merchant’s keys and limits, every call is journaled with the key used, and the licensed client’s operations team can revoke and reissue keys.
Updated: 2026-11-08