---
title: "Create Merchant API Keys"
method: POST
path: "/v4/merchants/{gateway_id}/security_keys"
tags: ["Gateway Features", "Merchants"]
---

# Create Merchant API Keys

`POST /v4/merchants/{gateway_id}/security_keys`

> ❗️ Never Use Real API Keys
>
> Never use real API Keys when testing. The gateway allows Partners to create Test Merchant Accounts. Testing should always use keys from the Test Accounts and never keys from a Standard Account.
<details>
<summary>Usage</summary>
This request will create a new API key for a user on a merchant account. The request includes all key types, including those for the Payment API, Query API, Collect.js, and Collect Checkout.
</details>

<details>
<summary> Sending User ID</summary>
The `userId` is optional, and will default to the primary user on the account if it is not provided.

A full list of user IDs on merchant accounts can be queried via [Get Merchant or Partner User Info](getmerchantorpartneruserinfo).
</details>

## Path parameters

- `gateway_id` string, required

## Headers

- `Authorization` string, required

## Request body

- CreateMerchantKeysRequest
  - `userId` string — The merchant user for whom to generate the API key. Optional and will default to primary user on the account if it is not provided.
  - `description` string, required — Description associated with the new key.
  - `permissions` string[], required

## Response `200`

Success

- CreateMerchantKeysResponse
  - `objectType` 'securityKey' — The type of object that was created as a result of the request.
  - `id` string — The ID of the merchant key that was created.
  - `keyText` string — The value of the key to be sent in with API requests or passed into Collect.js. This can be accessed later in the Security Keys section of the Merchant's Settings.
  - `userId` string — The merchant user ID associated with the key that was created.
  - `description` string — The description assigned to the key. Matches that passed in the request.
  - `permissions` string[] — The permissions assigned to the key. Matches those passed in the request except that `tokenization` will be added to `collectCheckout` keys automatically.

---

[API](https://skmtc.net/nmi/apis/embedded-components-api.md) · [All operations](https://skmtc.net/nmi/apis/embedded-components-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nmi/embedded-components-api/versions/45c2ecda3685/schema)