Issue a new API key for the Payment Element, scoped to one or more properties.

The response includes both the identity (public) and the secret (private). The secret is only returned once at creation time and cannot be retrieved later.

Important: Treat the secret as a password. Store it in a secure vault or secrets manager. Do not log it, commit it to source control, or expose it in client-side code.

Using with the Payment Webcomponent

To initialize the payment webcomponent your backend must produce a token from the identity and secret, then populate the webcomponents api-key field. The token format is:

{identity}.{base64(HMAC_SHA256(message, secret))}

Where:

• message is the literal string "{identity}|{property_id}" (UTF-8 bytes, pipe-separated, no surrounding whitespace).
• secret is the value returned by this endpoint, used as-is (its raw ASCII bytes). Do not base64-decode it before signing.
• The HMAC digest is the raw 32 bytes of HMAC-SHA256, then standard base64 encoded (not base64url, no = stripping).
• The token is the identity, a literal ., then the base64 digest.

{
  "property_ids": [
    12345,
    67890
  ]
}

{
  "identity": "pek_a1b2c3d4e5f6g7h8i9j0k1l2",
  "secret": "hNRMf27aSRBJcSUNhFbeoJFkvEehq2pmSjnc6PTWoT",
  "property_ids": [
    12345,
    67890
  ],
  "status": "active",
  "created_at": "2026-03-10T14:30:00.000000Z"
}