Find and protect your API credentials

Open [Developer → API credentials](https://dashboard.payerone.com/developer/api-keys), then select **Show Keys**. The page displays your live **Merchant Token** and **Private Key**. Copy each only to the server setting that needs it, then select **Hide Keys**.

Merchant Token

Send the Merchant Token in the `Authorization` header when your server calls the merchant Payments API. JSON request bodies also use `Content-Type: application/json`.

Authorization: Bearer YOUR_MERCHANT_TOKEN
Content-Type: application/json

Private Key

Use the Private Key as the secret for HMAC SHA-256 verification of incoming PayerOne webhook bodies. The resulting signature is compared with `X-PayerOne-Signature`. The Private Key is separate from the Merchant Token and is not the Bearer credential.

Store credentials safely

Keep both values in server-side configuration or your server secret manager. Do not put them in browser JavaScript, a mobile bundle, a public repository, a support message, or an AI conversation. Redact authorization headers and private keys from application logs.

**Refresh** on the API Keys page fetches the keys again; it does not present a key rotation control. If a key was exposed, stop sharing it, remove public copies, and contact PayerOne support for the appropriate account recovery action.

The API Keys page provides live credentials. The retired PayerOne sandbox does not issue test credentials.