Issue a new API key pair

Generates a new token + webhook signing secret pair for a merchant. Previous credentials are immediately invalidated. The `secret` is shown exactly ONCE — store it securely.

POST/api/v1/p2p/merchant/api-keys

Generates a new token + webhook signing secret pair for a merchant. Previous credentials are immediately invalidated. The secret is shown exactly ONCE — store it securely.

Authorization

MerchantToken MerchantSignature

X-Merchant-Token<token>

64-character hex public merchant token assigned during onboarding.

In: header

X-Signature<token>

Stripe-style HMAC-SHA256 signature. Format: t=<unix_seconds>,v1=<hex_hmac_sha256> where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>"). Replay window: 5 minutes (60s future drift tolerated).

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

tenant_id?string

Injected from auth context.

Formatuuid

merchant_id?string

Injected from auth context.

Formatuuid

Response Body

`application/json`

`application/problem+json`

curl -X POST "https://example.com/api/v1/p2p/merchant/api-keys" \  -H "Content-Type: application/json" \  -d '{}'

{  "token": "string",  "secret": "string"}

{  "type": "../dictionary",  "title": "string",  "status": 0,  "detail": "string",  "instance": "../dictionary",  "errors": [    {      "field": "amount",      "message": "must be greater than 0",      "code": "POSITIVE_REQUIRED"    }  ]}