API Keys

DirectCryptoPay uses two types of API keys for different purposes.

Key Types#

Public API Keys#

Public API keys provide programmatic access to the /api/v1/ REST API. Use these for:

• Backend integrations (Node.js, Python, PHP, etc.)
• Automation tools (Zapier, Make, n8n)
• AI agents and custom scripts
• Reporting and analytics dashboards

Prefix: dcp_pk_live_ (mainnet) or dcp_pk_test_ (testnet)

Integration Keys#

Integration keys are tied to a specific integration and used by the embeddable widget and SDK. They inherit the chain/token restrictions of their integration.

Prefix: dcp_live_ (mainnet) or dcp_test_ (testnet)

Generating Public API Keys#

1. Log in to your Dashboard
2. Navigate to Settings > API Keys
3. Select the Public API Keys tab
4. Click Generate API Key
5. Set a name, select scopes, and optionally set an expiration
6. Copy and save the key -- it's only shown once

Available Scopes#

Generating Integration Keys#

1. Navigate to Settings > API Keys
2. Select the Integration Keys tab
3. Choose the integration to link the key to
4. Click Generate Integration Key
5. Copy and save the key

Using Your API Key#

Public API (REST)#

Include the key in the X-API-Key header:

curl https://api.directcryptopay.com/api/v1/payment-links \
  -H "X-API-Key: dcp_pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Or use the Authorization header:

curl https://api.directcryptopay.com/api/v1/payments \
  -H "Authorization: Bearer dcp_pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Widget / SDK#

The widget uses an Integration ID rather than the raw API key:

<script src="https://widget.directcryptopay.com/dcp-widget.umd.js"></script>
<script>
  DirectCryptoPay.init({
    integrationId: 'your-integration-id'
  });
</script>

WordPress Plugin#

Enter the integration API key in the WooCommerce settings:

WooCommerce > Settings > Payments > DirectCryptoPay > API Key

Webhook Secret#

In addition to API keys, each integration has a Webhook Secret for verifying incoming webhook notifications. This is separate from API keys.

1. Go to Dashboard > Integrations
2. Click Edit on your integration
3. In the Webhook Configuration section, click Show to reveal the secret
4. Copy it for use in your webhook verification logic

You can rotate the secret at any time by clicking Rotate.

See the Webhooks guide for verification instructions.

Security Best Practices#

• Never expose keys in client-side code -- API keys are for server-side use only
• Use environment variables -- Store keys in .env files, not in source code
• Use minimal scopes -- Only grant the permissions your integration needs
• Set expiration dates for temporary integrations or contractor access
• Rotate keys regularly -- Revoke old keys and generate new ones
• Use separate keys per environment -- Testnet and mainnet have different keys

# .env (do not commit this file)
DCP_API_KEY=dcp_pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
DCP_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx