Authentication & API keys

Authenticate server-to-server requests with a secret API key in the Authorization header:

GET /v1/payment-intents HTTP/1.1
Host: api.feitpay.com
Authorization: Bearer gp_live_YOUR_KEY

Key types

Prefix	Environment	Where it lives	Status
gp_live_…	Live LIVE · after account activation	Your server or secret manager	Available once your account is activated, under Integrate → API keys; refused before that with live_keys_disabled

This platform is live-only: live keys are the only API keys, and every request made with one acts on real payments. The key decides the organization and the environment. Any Gryphem-Organization header is ignored for API keys, and tenant ids sent in request bodies are never trusted.

Never ship secret keys to browsers or mobile apps

Secret keys can create payment intents and manage webhooks. Keep them on your server. The official TypeScript SDK refuses gp_live_ keys in a browser. Customer-facing code only ever needs the hosted checkout URL or a checkout session id.

Scopes

Grant each key only what it needs. Scopes are fixed at creation; to change them, create a new key.

Scope	Allows
payments:read / payments:write	Payment intents, checkout sessions, timelines, transactions
invoices:read / invoices:write	Invoices
links:read / links:write	Payment links
wallets:read / wallets:write	Receive wallets and ownership proofs
webhooks:read / webhooks:write	Webhook endpoints, deliveries, events, secret rotation
stores:read	Stores and branding
customers:read	Customers derived from payment intents
reports:read	Payment and reconciliation reports
reconciliation:read	Discrepancies
billing:read	Platform invoices and usage
audit:read	The organization’s audit log
balances:read	Custodial balances
payouts:read / payouts:write	Reading payouts, payout assets and allow-listed addresses; requesting and cancelling payouts. Approving payouts and adding or removing addresses need a dashboard session

A request outside a key’s scopes fails with permission_error. Keys can optionally be restricted to one store, an IP allowlist and an expiry date.

Storage and display

• The full secret is shown once at creation (or when you roll a key). GRYPHEM PAY stores only a keyed hash plus a short prefix (for example gp_live_Ab12) so you can identify keys in the dashboard.
• last_used_at helps you find unused keys to revoke.
• Request logs never contain Authorization headers or bodies.

Rotation

Roll a key from Integrate → API keys: the old key is revoked and a replacement with the same scopes is created. Deploy the new key, then confirm the old prefix no longer appears in your request logs. If a key may have leaked, revoke it immediately — revocation takes effect on the next request.

Other credentials (not for your integration)

• Dashboard sessions (gps_…) are held server-side by the dashboard in an HttpOnly cookie and are never exposed to browser JavaScript.
• Checkout visitors are authorised only by the unguessable checkout session id in the URL; public checkout endpoints return sanitized data and never accept API keys.
• Operator and watcher credentials are internal and are not accepted on the merchant API.