Authorization
API Authorization
Cryptonly API requests must be authorized with an API key.
API keys are used for server-to-server communication and allow your systems to interact with Cryptonly on behalf of your organization.
Who can manage API keys?
Only tenant administrators can manage API keys.
Tenant administrators can:
create API keys
rename API keys
revoke API keys
view existing API keys in the admin application
If you do not see API key management options, your account may not have administrator permissions.
Where to manage API keys
API keys are managed in the Cryptonly admin application under Settings → Security.
To manage API keys:
open the admin app
go to Settings → Security
use the API keys section
In this section, you can:
view existing keys
create a new key
rename a key
revoke a key
The Webhook Signing Key for verifying invoice.statusChanged and withdrawal.statusChanged payloads is also shown on Settings → Security.
How to use an API key
Include your API key in the x-tenant-api-key header of each API request.
All authenticated requests must be sent over HTTPS.
Security best practices
API keys should be treated like passwords.
To keep your integration secure:
store API keys only in secure backend environments
never embed API keys in frontend code
never commit API keys to source control
use secret managers or secure environment variables
rotate keys periodically
revoke keys that are no longer needed
restrict access to production keys within your team
If you believe an API key has been exposed, revoke it immediately and create a new one.
Recommended usage model
The recommended integration pattern is:
your frontend communicates with your backend
your backend communicates with Cryptonly
your backend signs requests using the API key
This ensures that API credentials remain under your control.
Revoking a key
If an API key is no longer needed, or if you suspect it has been compromised, revoke it from the admin application.
Once revoked, the key can no longer be used to authorize API requests.
Notes
API keys identify your tenant when calling the Cryptonly API
API keys are intended for backend use only
only tenant administrators can manage API keys
revoked keys stop working immediately
Short Summary
Cryptonly uses API keys for server-to-server API authorization.
An API key identifies your tenant and allows your backend systems to call Cryptonly APIs securely. Only tenant administrators can manage API keys in the admin application.
Last updated