> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payfi.global/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Partner API key lifecycle.

PayFi generates a public key and private secret for each partner integration. The private secret is returned once during creation or rotation and is never shown again.

Store the private secret in your secret manager. PayFi stores it encrypted and validates requests by decrypting the active secret for the public key.

After PayFi creates the partner account, the partner admin signs in to the dashboard and generates the API key. Use the public key in `X-PayFi-Api-Key` and the private secret to sign every Partner API request.

If a private secret is lost or exposed, ask PayFi support to rotate the key. After rotation, deploy the new secret from your secret manager and stop using the old one.

## Dashboard access

PayFi dashboard access is separate from signed Partner API authentication:

* `ADMIN` is an internal PayFi administrator and can create partner integrations, partner admins, admins, and operators.
* `PARTNER` is the administrator for one partner integration. It can manage API keys, document requirement settings, compliance/risk configuration, operations, customers, documents, manual review, and operators for its own `partnerIntegrationId`.
* `OPERATOR` belongs to one partner integration but only receives the endpoint keys explicitly granted in `allowedEndpointKeys`.

Partner admins cannot choose or override `partnerIntegrationId` when using partner-scoped dashboard endpoints. PayFi resolves that scope from the logged-in user profile.