Skip to main content
Use an API key for requests from your organization’s backend, an OAuth access token for access granted by a user, and a signing key to authorize payout finalization:

​
API keys

To create an API key, open your organization settings in the dashboard and go to the API Keys tab. Each key belongs to that organization and environment. A sandbox key does not work in production. Keys have explicit permissions and can expire. Send the key in the x-api-key header; the SDK does this for you:

​
OAuth access tokens

When acting on behalf of a user who granted your organization scopes — reading a payee’s profile, KYC status, or tax certificates — authenticate with a Bearer token instead. Exchange and refresh tokens through pvium.oauth, and pass accessToken per request. Access is checked against the user’s granted scopes on every call — see Scopes and invites.

​
Signer keys

To finalize a payout, sign its details with your organization’s signing key. The smart contract verifies the signature before executing the authorized payout.
  • Keep it in backend secret storage, an HSM, or a KMS; the SDK accepts a custom signing function if the key never leaves that boundary.
  • It is never sent to Pvium — only signatures are.
For the full picture — the funding signer’s role and the scoped payout keys it can authorize — see Signing keys.

​
Handling credentials

  • Keep all three credential types out of browser and mobile client code.
  • Rotate API keys when team access changes or on suspected exposure.
  • Give each integration the narrowest key permissions that work.
  • A leaked API key cannot fund a payout — funding always requires the signed checkout — but treat rotation as urgent anyway.