> **Description:** Overview of the API key types available to partners, their access levels, and how to use them. # API keys for partners Partners help [their merchants](https://developer.vippsmobilepay.com/docs/partner/merchant-signup.md) create integrations and manage their sales units using the Vipps MobilePay API platform. API keys establish your identity and determine what you are authorized to do. Partners use different key types depending on their role -- each type grants access to a different set of APIs. To get API keys, the partner submits the merchant's consent, and after verification we connect the partner and merchant in the system. ```mermaid flowchart LR K[" API keys"] -->|"exchange for"| T[" Access token"] T -->|"include in every"| R[" API request"] ``` API keys are exchanged for an access token, which must then be included in every API request. ## Types of API keys A partner can hold more than one set of keys. For example, a partner who handles both payments and accounting will have two separate sets: accounting keys and partner keys. * [Partner keys](#partner-keys) -- Allow partners to act on behalf of all their merchants. See [Standard authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/standard-authentication.md) for the full list of APIs partner keys give access to. Partners can also use the [Login API](https://developer.vippsmobilepay.com/docs/APIs/login-api/README.md) with partner keys via a slightly different flow -- see [Login API: Partner keys](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/partner-keys.md). * [Sales unit keys](#sales-unit-keys) -- The merchant's own keys for one of their sales units. Provide access to the [common APIs](https://developer.vippsmobilepay.com/docs/APIs/README.md) the merchant has access to. Used by smaller partners who don't have partner keys. * [Accounting keys](#accounting-keys) -- Provide access to the [Report API](https://developer.vippsmobilepay.com/docs/APIs/report-api/README.md) only. Cannot be used to act on behalf of merchants or to access the Management API. * [Management keys](#management-keys) -- (DEPRECATED) Provide access to the [Management API](https://developer.vippsmobilepay.com/docs/APIs/management-api/README.md) only. Useful when you don't have partner keys, or cannot use them for security reasons. * Merchant-level keys -- (Not used by partners) Merchants using the [Donations API](https://developer.vippsmobilepay.com/docs/APIs/donations-api/README.md) use a separate key type called *Merchant-level keys* or *Donation keys*. Partners can access this API with their partner keys. ## How to get API keys After submitting the partner application form, you'll receive a welcome email with a test sales unit, API keys, documentation links, and an overview of the required steps of the partner onboarding process. If you have lost this or need a new test sales unit, please contact [partner@vippsmobilepay.com](mailto:partner@vippsmobilepay.com). Sales units are unique per country. Remember to state which country the sales unit should be created for. Note that partner functionality is not available in test. Instead, you will receive merchant API keys, as mentioned in the [limitations](https://developer.vippsmobilepay.com/docs/knowledge-base/test-environment.md#limitations-of-the-test-environment) section. All payment flows can be tested using the merchant's API keys. See [Partner: How to get access for your sales units](https://developer.vippsmobilepay.com/docs/partner/how-to-check-details.md#how-to-get-access-to-your-sales-units). ## Which keys do I need? You will use sales unit keys in two situations: * **In the test environment.** Partner keys don't work there. You get test sales unit keys in your welcome email -- see [Test environment](https://developer.vippsmobilepay.com/docs/knowledge-base/test-environment.md). * **Sometimes in production**, when you can't use partner keys. Then you use the merchant's own sales unit keys, which you must [get securely from the merchant](#partner-keys). Sales unit keys provide access to: * [Main and supporting APIs](https://developer.vippsmobilepay.com/docs/APIs/README.md#main-apis) * [Management API](https://developer.vippsmobilepay.com/docs/APIs/management-api/README.md) * [Report API](https://developer.vippsmobilepay.com/docs/APIs/report-api/README.md) It is better to use your partner, management, or accounting keys instead of the merchant's own keys. Partner keys provide access to: * [Main and supporting APIs](https://developer.vippsmobilepay.com/docs/APIs/README.md#main-apis) * [Management API](https://developer.vippsmobilepay.com/docs/APIs/management-api/README.md) * [Donations API](https://developer.vippsmobilepay.com/docs/APIs/donations-api/README.md) Accounting keys provide access to: * [Report API](https://developer.vippsmobilepay.com/docs/APIs/report-api/README.md) ### Sales unit keys Sales unit keys are the merchant's own keys for a single sales unit, obtained from the [business portal](https://portal.vippsmobilepay.com). Older documentation calls these *merchant keys*. If you have [partner keys](#partner-keys), use those instead. ### Partner keys Partners at [*Partner Plus* or above](https://vippsmobilepay.com/en-NO/partner) may qualify for partner keys. These allow a partner to use a single set of API keys across all their merchants' sales units, acting on behalf of merchants without needing each sales unit's own keys. Partner keys are used exactly like sales unit keys, with one difference: the `Merchant-Serial-Number` [HTTP header](https://developer.vippsmobilepay.com/docs/knowledge-base/http-headers.md) is *required*, not just recommended. Partner keys provide access to the [main APIs](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/README.md#choose-your-authentication-flow) and the [Management API](https://developer.vippsmobilepay.com/docs/APIs/management-api/README.md). * Partner keys only work in the production environment. In the [test environment](https://developer.vippsmobilepay.com/docs/knowledge-base/test-environment.md), partner functionality is not available -- you will use the test sales unit keys provided in your welcome email instead. All payment and login flows can be tested with these keys. * You *must not* use partner keys if merchants can see or access them in any way -- this would allow one merchant to act on behalf of all others. * Vipps MobilePay cannot send a merchant's sales unit keys to you directly. You must obtain them securely from the merchant. See [API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/api-keys.md#getting-the-api-keys) for details. If the merchant cannot share keys securely, they can [create a user for you in the business portal](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#add-a-new-user). * Partner keys work for all sales units registered with the partner, regardless of when the sales unit was created. **WARNING** Keep the API keys secret: Your API keys *must never be shared in any readable way with the merchants*, as that will let one merchant perform API calls (including making payments and refunds) on behalf of another merchant. **Potential pitfalls** :bomb: If your answer is *yes* to any of the following questions, don't use partner keys: * Your merchants can see the partner keys (`client_id`, `client_secret`, `Ocp-Apim-Subscription-Key`) in your solution. * Your merchants have the ability to *change* their MSN (Merchant Serial Number) in your solution. * The keys and secrets are stored on the merchant's system (in a way that allows them to access and see it). Partner keys don't give access to the [Report API](https://developer.vippsmobilepay.com/docs/APIs/report-api/README.md), because it can reveal information about a merchant's prices and fees, including information that is regulated by GDPR. For this, you need [Accounting keys](#accounting-keys). **Authentication** Use [standard authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/standard-authentication.md) with partner keys. ### Accounting keys Accounting keys provide access to the [Report API](https://developer.vippsmobilepay.com/docs/APIs/report-api/README.md) for retrieving payment and settlement data. The merchant must [explicitly give consent](https://developer.vippsmobilepay.com/docs/APIs/report-api/api-guide/overview.md#give-access-to-an-accounting-partner) before an accounting partner can access their data. Accounting keys cannot be used to manage sales units or make payments, and have no overlapping functionality with the other key types. Partners who also hold partner keys still need a separate set of accounting keys to access the Report API. **Authentication** Use [specialized authentication](https://developer.vippsmobilepay.com/docs/APIs/access-token-api/specialized-authentication.md) with accounting keys. ### Management keys **Deprecated** Management keys are deprecated. Partners should use their partner keys or the merchant's sales unit keys instead. Management keys provide access to the Management API only -- they cannot be used to act on behalf of merchants or make payments. They should only be be used when [partner keys](#partner-keys) is not appropriate for security reasons. ## Lost or compromised API keys For partner-level keys, [contact our partner team](https://developer.vippsmobilepay.com/docs/contact.md#are-you-a-partner-needing-support). For a merchant's sales unit keys, the merchant must regenerate them via the [business portal](https://portal.vippsmobilepay.com) -- see [How to regenerate API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-regenerate-api-keys) for step-by-step instructions. Update your integrations after regenerating keys so they continue to work. > **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).