Sign in

v50

latestOpenAPI 3.1.0raw.githubusercontent.com2026-07-131362831.1 MB
API credentials - merchant level

Create an API credential

Creates an API credential for the company account identified in the path. In the request, you can specify the roles and allowed origins for the new API credential.

The response includes the:

Make sure you store the API key securely in your system. You won't be able to retrieve it later.

If your API key is lost or compromised, you need to generate a new API key.

To make this request, your API credential must have the following roles:

  • Management API—API credentials read and write
post/merchants/{merchantId}/apiCredentials

Path parameters

merchantIdstring required

The unique identifier of the merchant account.

Request body

allowedOriginsstring[]

The list of allowed origins for the new API credential.

descriptionstring

Description of the API credential.

rolesstring[]

List of roles for the API credential. Only roles assigned to 'ws@Company.<CompanyName>' can be assigned to other API credentials.

Response

OK - the request has succeeded.

activeboolean required

Indicates if the API credential is enabled. Must be set to true to use the credential in your integration.

allowedIpAddressesstring[] required

List of IP addresses from which your client can make requests.

If the list is empty, we allow requests from any IP. If the list is not empty and we get a request from an IP which is not on the list, you get a security error.

apiKeystring required

The API key for the API credential that was created.

clientKeystring required

Public key used for client-side authentication. The client key is required for Drop-in and Components integrations.

descriptionstring

Description of the API credential.

idstring required

Unique identifier of the API credential.

passwordstring required

The password for the API credential that was created.

rolesstring[] required

List of roles for the API credential.

subjectDNstring

The subject DN of the certificate issued by Adyen.

usernamestring required

The name of the API credential, for example ws@Company.TestCompany.

Example response

{
  "allowedOrigins": [
    {
      "domain": "https://adyen.com"
    }
  ]
}