Authorization
Cryptonly API requests must be authorized with an API key. Send the key from your backend.
Who can manage API keys?
Section titled “Who can manage API keys?”Only organization administrators can manage API keys.
Organization administrators can:
- create API keys
- edit a key’s name and scopes
- delete API keys
- view existing API keys
If you do not see API key management options, your account may not have administrator permissions.
Where to manage API keys
Section titled “Where to manage API keys”API keys belong to an account. They are managed in the Cryptonly admin application under Accounts → Settings → Security.
To manage API keys:
- Open the admin app.
- Go to Accounts and select the account.
- Open the Settings tab, then Security.
- Use the API Keys section.
A key acts as that account. Requests authenticated with it operate on the account it was created for.
In this section, you can:
- view existing keys (name and scopes; the secret is not shown again)
- create a new key — set a name and at least one scope, then copy the secret immediately
- edit a key’s name and scopes
- delete a key
The secret is shown only once, when the key is created.
The Webhook signing key for verifying invoice.statusChanged, deposit.statusChanged, and withdrawal.statusChanged payloads is on the same Security page, under API Keys. It is also per account. The page shows a fingerprint. Rotate key replaces the current key immediately and shows the new secret once. Only organization administrators can view the fingerprint or rotate the key.
How to use an API key
Section titled “How to use an API key”Include your API key in the x-tenant-api-key header of each API request.
x-tenant-api-key: YOUR_API_KEYAll authenticated requests must be sent over HTTPS.
Deleting a key
Section titled “Deleting a key”If an API key is no longer needed, or if you suspect it has been compromised, delete it from the account’s Security page.
Once deleted, the key can no longer be used to authorize API requests.