Skip to main content
POST
Regenerate API secret

Authorizations

X-Signature
string
header
required

HMAC signature authentication for backend integrators.

Required Headers:

  • X-Integrator-Key: Integrator API key (format: int_...)
  • X-Signature: HMAC signature (format: sha256={hex})
  • X-Timestamp: Unix timestamp in milliseconds
  • Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

  • timestamp: Unix timestamp in milliseconds
  • METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
  • path: Request path (e.g., /v1/transactions)
  • bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key
string
header
required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp
string
header
required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Body

oldSecretValidForSeconds
number
default:0

Grace period in seconds during which the old secret remains valid. Allows for safe rotation without service disruption. Default: 0 (immediate invalidation), Maximum: 3600 (1 hour).

Required range: 0 <= x <= 3600
Example:

300

Response

Response for status 200

secret
string
required

The newly generated API secret. This is the only time the secret will be exposed - store it securely.

Example:

"sk_live_abc123def456ghi789"

oldSecretExpiresAt
string<date-time>

ISO 8601 timestamp when the old secret will expire. Only present if a grace period was specified.

Example:

"2026-08-06T14:33:21.833Z"