Skip to main content
Send the environment-specific API key in the Authorization header:
The complete key is displayed once. Store it in a secret manager and never commit it, log it, put it in a URL, or paste it into this documentation site.

​
Get a sandbox key

An Organization administrator creates sandbox keys in PayPathIQ under Settings → API access (/app/settings/api-access). A Client administrator can create them for their own Client under Settings → API access in the Client portal (/client/settings).
  1. Sign in to PayPathIQ and open Settings → API access.
  2. Under Create sandbox API key, enter an Integration name and choose the approved Client and Portfolio. The Client code is shown in brackets after the Client name. Use it as clientCode in API URLs.
  3. Select Create sandbox key, then copy the key before you select I have stored the key. PayPathIQ cannot show the key again.
A Client needs an approved Portfolio before a key can be created for it. If you do not have PayPathIQ access, ask your PayPathIQ administrator to create the key and share it through your secret manager. For help, email help@paypathiq.com. Never email an API key. Production keys are issued separately by PayPathIQ after sandbox testing. See the go-live checklist.

​
Scopes

Each key resolves to server-side grants for an Integration, Client, Portfolio, scopes, environment, and an approved credit_union.v1 or property_management.v1 profile. The URL clientCode must match a current grant. Unknown and unauthorized Client codes both return 403 client_scope_denied. Each operation needs one scope: New sandbox Integrations receive all fourteen scopes. Existing grants keep their approved scopes until explicitly changed. A production grant may receive fewer. A request without the needed scope returns 403 client_scope_denied.

​
IP allowlist

A grant can have an optional IP allowlist. It applies to every key of that Integration’s grant, not to one key. A request from an address outside the allowlist returns 403 client_scope_denied.

​
Rotation and revocation

Keys support overlapping rotation so you can deploy a replacement before revoking the old key. Revocation is immediate and irreversible. A revoked or invalid key receives a generic 401 invalid_api_key response. Administrators can rotate and revoke sandbox keys on the same API access page. To change a production grant, rotate a production key, or revoke production access, contact your PayPathIQ Integration administrator.