API keys can be scoped to specific permissions so that each key only has access to what it needs. This follows the principle of least privilege.
How Permissions Work
Each API key has an explicit set of permissions. A key with no permissions assigned cannot access any endpoints — permissions must be explicitly granted at key creation.
A key with no permissions is denied access. This is by design for security.
Available Permission Scopes
Permission scopes correspond to the API's functional areas:
Scope | What It Allows |
|---|---|
| Query transaction records |
| Create refunds |
| Create checkout sessions |
| Query account and onboarding status |
| Query store information |
Contact your account manager if you need a scope not listed above.
Origin Whitelisting
Each API key supports an allowed origins list. If configured, the key will only accept requests from those origins. This is useful for client-side integrations where you want to restrict which domains can use the key.
Regenerating a Key
Go to Developer → API Keys
Find the key and click Regenerate
The old key is immediately invalidated
Copy and store the new key
Treat API keys like passwords. Store them securely and rotate them regularly.