> **Description:** How to get and manage your Vipps MobilePay API keys — for merchants, partners, and Donations API users.

# API keys

API keys authenticate your API requests to Vipps MobilePay.

## What are API keys

*API keys* is the umbrella term for all of these:

| Key type | Description |
|---|---|
| **Sales unit keys** | Standard API keys provided to a merchant, allowing access to their sales unit. Each sales unit has its own separate set. Often just called "API keys", and called *merchant keys* in older documentation. Used by merchants and sometimes by partners acting on a merchant's behalf. |
| **Partner keys** | Elevated API keys provided to large partners, allowing access to all their merchants' sales units. Used by partners acting on behalf of all their merchants. |
| **Accounting keys** | Specialty keys provided to accounting partners, giving them access to the Report API for one of their merchants' sales units. |
| **Merchant-level keys** | Specialty keys provided to Donations product users, allowing them to review their donations proceeds. |

Which type of keys do I use?

* I am a small or medium-sized merchant -- you have sales unit keys, one set for each of your sales units.
* I am a partner acting on behalf of several merchants -- you have partner keys. If you handle accounting,
  you have accounting keys instead, or as well.
* I work with donations -- you have merchant-level keys or partner keys.

## Getting the API keys

The key type you need -- and how you get it -- depends on your role:

You will use **sales unit API keys**. Each sales unit has its own separate set.

Log in to the [business portal](https://portal.vippsmobilepay.com) and follow these steps:

1. Click <abbr title="If you don't see this, ask your Administrator to grant you Developer access">*For developers*</abbr> in the sidebar.
   You should see a list of sales units. Select *Test* or *Production*.
2. Find your sales unit and click *Show keys*.
   A panel opens where you can copy each key value.
3. Also copy the Merchant Serial Number (MSN) -- you will need it in API requests.

   Screenshot: API keys panel for sales unit showing four key fields: client_id, client_secret, Ocp-Apim-Subscription-Key (primary), and Ocp-Apim-Subscription-Key (secondary). Each has a Regenerate button. A note explains the primary and secondary keys are interchangeable.

If you accidentally expose your API keys, [regenerate them immediately](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-regenerate-api-keys).

For more information, see [about the business portal](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-find-the-api-keys).

You will usually use your **Partner keys** -- see [API keys for partners](https://developer.vippsmobilepay.com/docs/partner/partner-keys.md#partner-keys).

Accounting partners will use [**Accounting keys**](https://developer.vippsmobilepay.com/docs/partner/partner-keys.md#accounting-keys) for access to the Report API only.

Partners may occasionally use a merchant's own sales unit keys on behalf of that single merchant.

If you can't use partner keys, you have two options:

1. Ask the merchant to securely send their keys to you.
2. If the merchant can't share keys securely, they can [add a portal user](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#add-a-new-user) for you with *Assistant* access, so you can log in and retrieve the keys yourself.

If you compromise your partner keys, [contact the partner team](https://developer.vippsmobilepay.com/docs/contact.md#are-you-a-partner-needing-support) immediately.

You will use **merchant-level keys**. These belong to the business as a whole rather than to a single sales unit.

See [merchant-level keys](https://developer.vippsmobilepay.com/docs/APIs/donations-api/api-guide.md#how-to-get-the-api-keys) for details on how to find these.

## Production and test keys

As a merchant, you will need two separate sets of keys -- one for testing and one for production. Each set is tied to a specific sales unit and can only be used for that unit. If you have multiple sales units, you will have a separate set of keys for each one.

* **Test environment:** Keys are normally available a few minutes after the sales unit is created.
  See [How to create a test sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-create-a-test-sales-unit) for details.
* **Production environment:** Keys are normally available a few days after application, depending on
  workload and whether we need additional information.

**Keep your API keys secret**

API keys are sensitive information, so handle them carefully:

* Vipps MobilePay will never ask for your API keys.
* If you need to share keys with a colleague, always use encrypted email or a secure secret manager.
  If keys can't be moved securely, you can [create a portal user](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#add-a-new-user)
  for that person and give them basic access to the sales unit.
* If you accidentally expose your API keys, regenerate them immediately:
  * **Merchants:** Click the *Regenerate* button on your sales unit page in the [business portal](https://portal.vippsmobilepay.com). See [How to regenerate API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-regenerate-api-keys) for step-by-step instructions.
  * **Partners:** For partner-level keys, [contact the partner team](https://developer.vippsmobilepay.com/docs/contact.md#are-you-a-partner-needing-support). For a merchant's sales unit keys, the merchant must regenerate them via the business portal.
* Update your integrations after regenerating keys so they continue to work.

## API key details

The key names you receive depend on which authentication method your key type uses.

**Sales unit keys and partner keys**
([standard authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/standard-authentication.md))
include four values:

| API Key Name | Description | Format | Example |
|---|---|---|---|
| `client_id` | Client ID for the sales unit (the "username") | GUID | 00000000-0000-0000-0000-000000000000 |
| `client_secret` | Client secret for the sales unit (the "password") | Base64 | AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== |
| `Ocp-Apim-Subscription-Key` (primary) | Subscription key for the API product | Hex | 00000000000000000000000000000000 |
| `Ocp-Apim-Subscription-Key` (secondary) | Interchangeable with the primary key | Hex | 00000000000000000000000000000000 |

The primary and secondary `Ocp-Apim-Subscription-Key` values are interchangeable. Having two lets you rotate one without downtime while the other remains active.

**Accounting keys and Donations merchant-level keys** ([specialized authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/specialized-authentication.md)) use only `client_id` and `client_secret` -- there is no subscription key.

You use `client_id` and `client_secret` with the [Access Token API](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/README.md) to get an access token for subsequent API requests.

The same sales unit keys work across all integration types -- direct API, mobile
apps, point of sale, and [plugins](https://developer.vippsmobilepay.com/docs/plugins/README.md).

**TIP**

The Merchant Serial Number (MSN) is not an API key, but you will need it in many API requests. You can find it in the same place as your API keys in the business portal.

## Related pages

* **Partners:** See [API keys for partners](https://developer.vippsmobilepay.com/docs/partner/partner-keys.md) for the full overview of partner key types.

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).