---
title: "Generate a client secret for a merchant"
method: POST
path: "/api/v1/merchants/{id}/generate-secret"
tags: ["Merchants"]
---

# Generate a client secret for a merchant

`POST /api/v1/merchants/{id}/generate-secret`

## Request

- Base URL: `https://core.quidkey.com`
- URL: `https://core.quidkey.com/api/v1/merchants/{id}/generate-secret`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/banqzinc/apis/quidkey-api/docs/api/v1/merchants/:id/generate-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Generate a client secret for a merchant

## Path parameters

- `id` string, uuid, required: The unique identifier of the merchant

## Response `200`

Success

- MerchantGenerateClientSecretResponse
  - `success` boolean, required: Indicates if the request was successful
  - `data` object, required
    - `client_secret` string, required: The newly generated client secret

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

## Changes

- **2026-06-17** `b372e7d5563d`: 1 breaking, 1 warning, 2 info
  - the `error/code` response's property type changed from `string` to no type for status `400`
  - removed the optional property `error/errors` from the response with the `400` status
  - added the optional property `error/metadata` to the response with the `400` status
  - added `subschema #1, subschema #2` to the `error/code` response property `allOf` list for the response status `400`
- **2025-11-05** `6637b341d86d`: 1 info
  - endpoint added
- **2025-11-02** `919eb7a392aa`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/banqzinc/apis/quidkey-api/changes/api/v1/merchants/:id/generate-secret/post.md)

---

[API](https://skmtc.dev/banqzinc/apis/quidkey-api.md) - [All operations](https://skmtc.dev/banqzinc/apis/quidkey-api/llms.txt) - [OpenAPI document](https://skmtc.dev/banqzinc/apis/quidkey-api/revisions/f86d2bdbcb08?raw)