Regenerate API secret
Regenerates the integrator’s API secret. The new secret is returned in the response - this is the only time it will be exposed.
Grace Period: Optionally specify oldSecretValidForSeconds (0-3600) to keep the old secret valid during rotation. This prevents service disruption while updating your systems.
Warning: Without a grace period, the old secret is invalidated immediately. Any requests signed with the old secret will fail.
Store the new secret securely - it cannot be retrieved again.
Authorizations
HMAC signature authentication for backend integrators.
Required Headers:
- X-Integrator-Key: Integrator API key (format: int_...)
- X-Signature: HMAC signature (format: sha256={hex})
- X-Timestamp: Unix timestamp in milliseconds
- Authorization: Bearer {user-api-key}
Signature Algorithm: HMAC-SHA256
Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}
- timestamp: Unix timestamp in milliseconds
- METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
- path: Request path (e.g., /v1/transactions)
- bodyHash: SHA256 hex digest of request body (empty string if no body)
Timestamp Tolerance: ±5 minutes (300 seconds)
Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...
Integrator API key (format: int_...) used with HMAC authentication
Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.
Body
Grace period in seconds during which the old secret remains valid. Allows for safe rotation without service disruption. Default: 0 (immediate invalidation), Maximum: 3600 (1 hour).
0 <= x <= 3600300
Response
Response for status 200
The newly generated API secret. This is the only time the secret will be exposed - store it securely.
"sk_live_abc123def456ghi789"
ISO 8601 timestamp when the old secret will expire. Only present if a grace period was specified.
"2026-08-06T14:33:21.833Z"