> ## Documentation Index > Fetch the complete documentation index at: https://docs.ca.cryptoprocessing.com/llms.txt > Use this file to discover all available pages before exploring further. # Generate and activate API keys **Available to roles (Roles determine what each user can see and do in the portal.):** To start making API requests, generate and activate an API key. Use a **Master key** for full API access, choosing whether to allow access to withdrawal endpoints. Use a **Custom key** for read-only access to balances, transaction details, currency rates, or the list of supported currencies. API keys are tied to your merchant account, not to a specific portal user. ## Generate a Master key Use a Master key for integrations that require full API access. By default, a Master key can also create withdrawals. If your integration must not be able to create withdrawals, turn off **Allow withdrawals** in step 3. > [!NOTE] > > Only one Master key can be active at a time. **1. In your portal, go to the API keys tab.** **2. Click Generate API key and enter a unique name for the key.** The name can contain up to 50 characters. **3. Under Key type, select Master and choose whether to allow withdrawals.** **Allow withdrawals** is turned on by default. It controls all three withdrawal endpoints: * [/v2/withdrawal/crypto](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/withdrawal-crypto.md) * [/v2/crypto/withdrawal\_instant](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/crypto-withdrawal-instant.md) * [/v2/crypto/withdrawal\_instant\_exchange](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/crypto-withdrawal-instant-exchange.md) If you turn it off, requests to these endpoints made with this key are rejected. You can change this setting later by [editing the key](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#change-the-name-or-permissions-of-an-api-key). **4. Click Next step and optionally specify allowed IP addresses.** Use either IPv4 or IPv6 format, and separate multiple IP addresses with commas. If you leave this blank, requests from any IP address will be accepted. **5. Click Proceed, enter your 2FA code, and click Generate.** The key is added to the list with the **New** status. **6. Click Activate next to the API key, enter your 2FA code, and confirm the activation.** **Activate** is unavailable while another Master key is active. [Deactivate](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#deactivate-an-api-key) the active Master key first. > [!WARNING] > > Your secret key will be displayed after you click **Activate**. Make sure no one can see or record your screen. **7. Save your secret key and click Done.** Your secret key is displayed only once. Toggle **Secret key QR code** to display the secret key as a QR code. > [card] Do not share your secret key with anyone. > > If you think your secret key may have been compromised, [archive the API key](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#archive-an-api-key) immediately and contact our Support team. ## Generate a Custom key Use a Custom key for integrations that need access to specific functionality only, for example a reporting tool that reads balances and transactions. Multiple Custom keys can be active at the same time, alongside the active Master key. **1. In your portal, go to the API keys tab.** **2. Click Generate API key and enter a unique name for the key.** The name can contain up to 50 characters. **3. Under Key type, select Custom and choose the abilities.** Under **Allowed functionality**, select at least one ability the key may call: * **Balances** - [/v2/accounts/list](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/accounts-list.md) * **Transaction info** - [/v2/transactions/info](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/transactions-info.md) * **Currency rates** - [/v2/currencies/rates](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/currencies-rates.md) * **Currencies list** - [/v2/currencies/list](https://docs.ca.cryptoprocessing.com/api-reference/endpoints/currencies-list.md) For a reporting tool, select **Balances** and **Transaction info**. **4. Click Next step and optionally specify allowed IP addresses.** Use either IPv4 or IPv6 format, and separate multiple IP addresses with commas. If you leave this blank, requests from any IP address will be accepted. **5. Click Proceed, enter your 2FA code, and click Generate.** The key is added to the list with the **New** status. **6. Click Activate next to the API key, enter your 2FA code, and confirm the activation.** > [!WARNING] > > Your secret key will be displayed after you click **Activate**. Make sure no one can see or record your screen. **7. Save your secret key and click Done.** Your secret key is displayed only once. Toggle **Secret key QR code** to display the secret key as a QR code. > [card] Do not share your secret key with anyone. > > If you think your secret key may have been compromised, [archive the API key](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#archive-an-api-key) immediately and contact our Support team. ## FAQ ### What's the difference between the API key and the secret key? * **API key** - Specified in the `X-Processing-Key` header in API requests. You can view it in the **API keys** section of your portal. * **Secret key** - Used to generate an HMAC-SHA512 signature of the request body. The signature is specified in the `X-Processing-Signature` header in API requests. You can view the secret key only once, after activating the API key for the first time. ### How can I view my secret key if I lost it? If you don't have your secret key, [archive](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#archive-an-api-key) the corresponding API key, then generate and activate a replacement. ### What should I do if someone else got access to my secret key? If you suspect that your secret key was compromised, [archive the API key](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#archive-an-api-key) immediately and contact our Support team. Archived API keys cannot be reactivated. ### How do I disable withdrawals for an API key? Withdrawals are controlled by the **Allow withdrawals** setting, which is available for Master keys. To turn it off for an existing key, [edit the key](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#change-the-name-or-permissions-of-an-api-key) and turn off **Allow withdrawals**. Requests to the three withdrawal endpoints made with that key are then rejected. ### How do I manage allowed IP addresses for API requests? You can update the IP addresses a key accepts requests from at any time. See [Edit the IP whitelist](https://docs.ca.cryptoprocessing.com/merchant-administration/manage-api-keys.md#edit-the-ip-whitelist). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.