Skip to main content

​
Overview

Tender secures API requests with two authentication methods — Signed (HMAC) for most endpoints, and Basic (Access ID) for Payment and System endpoints (see Authentication). You’ll need two credentials:
  1. Access ID - Your public API identifier, sent with every request
  2. Access Secret - Your private key for signing requests to Signed (HMAC) endpoints
Never share your Access Secret or commit it to version control. Treat it like a password.

​
Generating API Credentials

API credentials belong to an outlet (agent). Payments you initiate with a key are attributed to that key’s outlet, and requests made with a key that isn’t linked to an outlet are rejected.
1

Log in to Dashboard

Navigate to sandbox-merchant.tender.cash (sandbox) or merchant.tender.cash (live) and log in to your account.
2

Navigate to API Settings

  • Click on Settings in the sidebar
  • Select API Credentials
3

Generate credentials for an outlet

  • Choose the outlet the credentials are for
  • Click Generate New Credentials
4

Save Your Credentials

Important: Copy both values and store them securely straight away.
  • Access ID: Copy this value
  • Access Secret: Copy this value
  • Store them in a secure location (password manager, environment variables, secrets manager)
Each outlet has one active set of credentials. Generating new credentials for an outlet immediately revokes that outlet’s previous credentials, so update every system that uses them straight away.

​
Test vs Production Credentials

Test Credentials are for:
  • Development and integration
  • Testing payment flows
  • Webhook testing
  • Uses testnet cryptocurrencies

​
Managing Credentials

​
Viewing Active Credentials

In the dashboard’s API Credentials settings you can see the active credentials for each outlet.

​
Rotating or Revoking Credentials

If credentials are compromised, or you want to rotate them:
1

Generate new credentials for the outlet

This revokes the outlet’s old credentials immediately. Requests that still use them fail with 401 INVALID_REQUEST_SIGNATURE.
2

Update your systems

Deploy the new Access ID and Access Secret to every system that calls the API for that outlet.
3

Monitor for issues

Check that all systems are working with the new credentials.
To revoke credentials without replacing them, delete them from the dashboard.

​
Next Steps

Authentication Guide

Learn how to sign API requests with your credentials

Quick Start

Make your first API call

​
Troubleshooting

Possible causes:
  • A missing signed header (NOT_ALLOWED)
  • An incorrect Access ID or Secret, or credentials that were replaced by newer ones (INVALID_REQUEST_SIGNATURE)
  • An invalid HMAC signature, or an x-timestamp more than 5 minutes from server time (INVALID_REQUEST_SIGNATURE)
  • Using sandbox credentials on the production URL (or vice versa)
Solution: Verify your credentials and signature generation. See Authentication.
Your merchant account is suspended. Contact support@tender.cash.
Check:
  • Are you using the correct environment (sandbox vs production)?
  • Have new credentials been generated for this outlet since you copied these?
  • Is the timestamp an ISO 8601 string within 5 minutes of the current time?
  • Is the signature generated over the exact header values?