> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tender.cash/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting API Credentials

> Generate and manage your Tender API credentials for authentication

## Overview

Tender secures API requests with two authentication methods — Signed (HMAC) for most endpoints, and Basic (Access ID) for Payment and System endpoints (see [Authentication](/api-reference/authentication)). You'll need two credentials:

1. **Access ID** - Your public API identifier, sent with every request
2. **Access Secret** - Your private key for signing requests to Signed (HMAC) endpoints

<Warning>
  Never share your Access Secret or commit it to version control. Treat it like a password.
</Warning>

***

## Generating API Credentials

<Steps>
  <Step title="Log in to Dashboard">
    Navigate to [sandbox-merchant.tender.cash](https://sandbox-merchant.tender.cash) (sandbox) or [merchant.tender.cash](https://merchant.tender.cash) (live) and log in to your account.
  </Step>

  <Step title="Navigate to API Settings">
    * Click on **Settings** in the sidebar
    * Select **API Credentials**
  </Step>

  <Step title="Create New Credentials">
    * Click **Generate New Credentials**
    * Give your credentials a descriptive name (e.g., "Production API", "Dev Server")
  </Step>

  <Step title="Save Your Credentials">
    <Warning>
      **Important**: Copy and securely store both credentials immediately. The Access Secret will only be shown once.
    </Warning>

    * **Access ID**: Copy this value
    * **Access Secret**: Copy this value (shown only once)
    * Store them in a secure location (password manager, environment variables, secrets manager)
  </Step>
</Steps>

***

## Test vs Production Credentials

<Tabs>
  <Tab title="Test Environment">
    **Test Credentials** are for:

    * Development and integration
    * Testing payment flows
    * Webhook testing
    * Uses testnet cryptocurrencies

    ```text theme={null}
    Base URL: https://sandbox-api.tender.cash
    ```
  </Tab>

  <Tab title="Production Environment">
    **Production Credentials** are for:

    * Live transactions
    * Real cryptocurrency payments
    * Production webhooks
    * Uses mainnet cryptocurrencies

    ```text theme={null}
    Base URL: https://secureapi.tender.cash
    ```

    <Warning>
      Only use production credentials after thorough testing in the test environment.
    </Warning>
  </Tab>
</Tabs>

***

## Managing Credentials

### Viewing Active Credentials

In the dashboard, you can:

* View all active API credentials
* See last used date
* Check usage statistics
* View credential names and environments

### Revoking Credentials

If credentials are compromised:

<Steps>
  <Step title="Generate new credentials">
    Create replacement credentials immediately
  </Step>

  <Step title="Update your systems">
    Deploy new credentials to all systems
  </Step>

  <Step title="Revoke old credentials">
    Delete compromised credentials from dashboard
  </Step>

  <Step title="Monitor for issues">
    Check that all systems are working with new credentials
  </Step>
</Steps>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Authentication Guide" icon="lock" href="/api-reference/authentication">
    Learn how to sign API requests with your credentials
  </Card>

  <Card title="Quick Start" icon="rocket" href="/quickstart">
    Make your first API call
  </Card>
</CardGroup>

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized Error" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Access ID or Secret
    * Invalid HMAC signature
    * Using test credentials on production endpoint (or vice versa)

    **Solution:** Verify your credentials and signature generation
  </Accordion>

  <Accordion title="Credentials not working" icon="circle-xmark">
    **Check:**

    * Are you using the correct environment (test vs production)?
    * Have the credentials been revoked?
    * Is the timestamp in the correct format?
    * Is the signature generated correctly?
  </Accordion>
</AccordionGroup>