# Create and manage API keys (/help-center/api-keys)



Open **Developers → API keys** in the dashboard. Keys are managed from a signed-in account; an API key cannot create more keys.

<AppPicture name="api-keys" alt="The API keys screen listing sample Storefront, Customer wallets, and Reporting keys with their kinds and scopes." caption="Give each integration a recognizable name and the access it needs. These are sample key identifiers." />

## Create a key [#create-a-key]

<Steps>
  <Step>
    ### Choose Create key [#choose-create-key]

    Select a kind: **Checkout** for payment requests, **Wallet** for customer wallet operations, or **Payout** for money-out operations. The form describes each kind.
  </Step>

  <Step>
    ### Name and restrict it [#name-and-restrict-it]

    Give the key a name you will recognize later. Review its scopes and the available IP and origin restrictions. Allowed origins become available after your business domain is verified.
  </Step>

  <Step>
    ### Save the secret [#save-the-secret]

    Create the key and store the token in your server's secret manager. It is shown once. Finish with **I have saved it** after you have stored it.
  </Step>
</Steps>

## Understand payout access [#understand-payout-access]

A payout key needs the right scope and signing permission before it can send money. Signing must be enabled at the service, merchant, and key levels. The [authentication guide](/concepts/authentication) explains those checks.

## Replace or revoke a key [#replace-or-revoke-a-key]

Use **Access** on a key's row to inspect and edit restrictions, **Roll** to replace it, or **Revoke** to stop it. Rolling creates a replacement and allows an overlap while your application changes over.

If you lost the token, roll the key; the stored secret cannot be revealed again. For a suspected leak, replace it promptly and revoke the exposed credential.

## Make your first API call [#make-your-first-api-call]

Once the key is stored, follow [Your first call](/start/first-call). Use the token in the Authorization header from your backend.