Skip to main content
Send the environment-specific API key in the Authorization header:
Sandbox and production key provisioning are target-contract capabilities. Public API hostnames and production key authentication are not live yet.
An Integration administrator creates separate sandbox and production keys. The complete key is displayed once. Store it in a secret manager and never commit it, log it, put it in a URL, or paste it into this documentation site. Each key resolves to server-side grants for an Integration, Client, Portfolio, scopes, environment, and the credit_union.v1 profile. The URL clientCode must match a current grant. Unknown and unauthorized Client codes both return 403 client_scope_denied.

​
Rotation and revocation

Keys support overlapping rotation so you can deploy a replacement before revoking the old key. Revocation is immediate and irreversible. A revoked or invalid key receives a generic 401 response. An optional IP allowlist can further restrict a key. Contact your PayPathIQ Integration administrator to change grants, rotate a key, or revoke access.