curl --request POST \
--url https://api.simplepay.mx/v1/api-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--header 'x-sp-step-up-token: <x-sp-step-up-token>' \
--data '
{
"tenant_id": "<string>",
"scopes": []
}
'const options = {
method: 'POST',
headers: {
'x-sp-step-up-token': '<x-sp-step-up-token>',
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({tenant_id: '<string>', scopes: []})
};
fetch('https://api.simplepay.mx/v1/api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.simplepay.mx/v1/api-keys"
payload = {
"tenant_id": "<string>",
"scopes": []
}
headers = {
"x-sp-step-up-token": "<x-sp-step-up-token>",
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"key": {
"created_at": "2023-11-07T05:31:56Z",
"created_by_email": "jsmith@example.com",
"description": "<string>",
"environment": "sandbox",
"expires_at": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"obfuscated_value": "<string>",
"scopes": [
"<string>"
],
"status": "active"
},
"object": "simplepay.v1.api_key",
"one_time_value": "<string>"
}API-only first-key bootstrap. Requires a verified customer bearer with active tenant/environment membership and admin RBAC; API keys and first-party assertions cannot call this route. Obtain x-sp-step-up-token from /v1/auth/step-up/* with action api_key.create, scope api_keys:write, the same tenant/idempotency selectors, and params_hash = lowercase SHA-256 of canonical stable JSON . Use the trimmed description or API key default, tenant_environment as environment, sorted unique scopes, recursively sorted object keys, UTF-8, and no whitespace.
curl --request POST \
--url https://api.simplepay.mx/v1/api-keys \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--header 'x-sp-step-up-token: <x-sp-step-up-token>' \
--data '
{
"tenant_id": "<string>",
"scopes": []
}
'const options = {
method: 'POST',
headers: {
'x-sp-step-up-token': '<x-sp-step-up-token>',
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({tenant_id: '<string>', scopes: []})
};
fetch('https://api.simplepay.mx/v1/api-keys', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.simplepay.mx/v1/api-keys"
payload = {
"tenant_id": "<string>",
"scopes": []
}
headers = {
"x-sp-step-up-token": "<x-sp-step-up-token>",
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"key": {
"created_at": "2023-11-07T05:31:56Z",
"created_by_email": "jsmith@example.com",
"description": "<string>",
"environment": "sandbox",
"expires_at": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"obfuscated_value": "<string>",
"scopes": [
"<string>"
],
"status": "active"
},
"object": "simplepay.v1.api_key",
"one_time_value": "<string>"
}Authorizations
SimplePay customer session bearer. Never a tenant API credential.
Headers
Short-lived, single-use SimplePay recent-auth proof bound to this mutation and Idempotency-Key.
32 - 40968 - 255Body
sandbox, live 1 - 128^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$1 - 64 elementsbookable_payments:read, bookable_payments:write, admission_control:manage, admission_control:redeem, customer_hub.contacts:write, customer_hub.notes:write, customer_hub.provider_sync:write, customer_hub.segments:read, customer_hub.segments:write, customer_hub:read, customer_hub:write, digital_catalog.inventory:read, digital_catalog.inventory:write, digital_catalog:read, digital_catalog:write, hosted_checkout:read, hosted_checkout:write, intelligence:read, payment_links:read, payment_links:write, physical_checkout:read, physical_checkout:write, table_pay:read, table_pay:write, policies:read, refunds:read, refunds:write, reporting:read, tap_to_pay:read, tap_to_pay:write, terminal:read, terminal:write, ticketing:read, ticketing:write, transfers:read, transfers:write, webhooks:read, webhooks:write, workspace:read, workspace:write 3 - 96120Response
API key created. one_time_value is returned once and is never persisted by SimplePay.
Hide child attributes
Hide child attributes
120sandbox, live active, failed, provisioning, revoked, revoking, rotating One-time plaintext credential. Never returned by list or replay and never persisted by SimplePay.
16