Skip to main content
API keys are the primary method of authentication for interacting with our APIs. They are organization-based, permission-scoped, and can be secured with IP restrictions.

Create and Manage API Keys

You can generate and manage API keys in your BitGPT 402pay Dashboard > Developers > API Keys section.

​
Linked to Organizations

API keys are issued at the organization level, not tied to individual users. This means:
  • Any action performed using an API key is attributed to the owning organization.
  • Multiple team members can collaborate using separate keys within the same organization.
  • API keys persist independently of individual user accounts.

​
Unlimited Keys per Organization

Each organization can create any number of API keys, allowing for flexibility across environments, services, or teams. Common usage patterns include:
  • One key per environment (e.g., development, staging, production)
  • One key per integration (e.g., billing automation, analytics)
  • Temporary keys for CI/CD or testing purposes

​
IP Restrictions

To enhance security, API keys can be restricted to specific IP addresses or subnets:
  • Supports IPv4, IPv6, and CIDR notation
  • Requests from unauthorized IPs will be rejected with a 403 Forbidden error
Example entries:
  • 192.168.1.10
  • 2001:0db8::/32
  • 203.0.0.0/8
Use IP allowlists to lock down critical integrations (e.g., production webhooks).

​
Scoped Permissions

Each API key can be limited to a specific set of scopes, defining what parts of the API it can access. You’ll be prompted to set these scopes when creating an API Key in the dashboard, if none are specified the API Key will have full permissions.
ScopeDescription
invoices.createCreate new invoices within your organization.
invoices.readRetrieve existing invoices or list all invoices.
products.createCreate new products in your catalog.
products.readView product details or list all products.
products.updateUpdate existing product information.
products.deleteDelete products from your catalog.
api_keys.createCreate new API keys for your organization. (Not available to developers)
api_keys.updateUpdate metadata or scopes of existing API keys. (Not available to developers)
api_keys.deleteDelete API keys. (Not available to developers)
api_keys.readView and list API keys associated with your organization.
webhooks.createRegister new webhook endpoints.
webhooks.readView registered webhooks or inspect configurations.
webhooks.updateModify existing webhook endpoints.
webhooks.deleteRemove webhook endpoints from your account.
webhooks_queue.readRead or inspect queued webhook delivery attempts.
webhooks_queue.updateRetry or manage failed webhook deliveries.
notifications.readView in-app or system notifications.
notifications.updateMark notifications as read or update their status.
notifications_settings.readAccess notification delivery preferences.
notifications_settings.updateModify how notifications are delivered.
This allows you to enforce principle of least privilege and isolate permissions per use case.
A request made with a key lacking the required scope will return 403 Forbidden.

​
Best Practices

  • Rotate keys regularly to minimize exposure
  • Use least privilege: only assign required scopes
  • Restrict by IP where possible
  • Avoid sharing keys between environments or teams
For key management, visit your Dashboard > Developers > API Keys. Need help? Contact support or refer to the Authentication Guide.