IOPAY→Developers→Credentials
Setup & authentication

Access credentials

How to obtain, store and apply the credentials used in IOPAY online payment integrations.

FieldsEmail · IO Seller ID · Secret · Antifraud ID
Where to generateSales → Online Payments
AuthenticationBearer token
How to obtain See credentials Base API →
Overview

Overview

Credentials enable online payment integrations. The Secret must stay in the backend and out of repositories or public interfaces.

Security

The Secret is confidential.

The Secret must remain only in the backend and in suitable secret vaults.

Rotation

Regenerating invalidates the previous key.

Plan the Secret change to avoid downtime during rotation.

How to obtain

How to obtain

  1. Access the IO Digital Account.
  2. Go to Sales → Online Payments.
  3. Enable online payments, when applicable to the registration.
  4. Generate the credentials and store the values in a secure environment.
  5. Set up payment methods and, finally, the checkout integration options.
Secret. The Secret is shown only at the moment it is generated. If you need to generate another, the previous key is invalidated.
Integration credentials

Fields

KeyPurposeNote
emailIdentification associated with the integration.Sent during authentication.
io_seller_idIdentifier of the seller/account in the IOPAY context.Sent during authentication and used in the context of the operation.
secretAuthentication secret.Sent during authentication. Never expose it in the frontend.
antifraud_idIdentifier related to the antifraud plan.Not required when the account has no active antifraud plan.

Authenticate the integration

Send email, secret and io_seller_id to obtain the token used in the next API calls.

POST /auth/login
curl --request POST \
  --url https://api.iopay.com.br/api/auth/login \
  --header 'Content-Type: application/json' \
  --data '{
    "email": "your_email",
    "secret": "your_secret",
    "io_seller_id": "<IO_SELLER_ID>"
  }'

Response

Access token
{
  "access_token": "<ACCESS_TOKEN>",
  "token_type": "bearer",
  "token_scope": "transaction",
  "expires_in": 3600
}
Bearer Token. Use the returned access_token as Authorization: Bearer your_token in the next API calls.
Additional setup

Setup

After the credentials, the online payments setup can include Credit, Pix and Boletos, number of installments and checkout parameters.

Webhook

Notification URL.

Provide an HTTPS URL to receive notifications from the operation.

Domain

HTTPS restriction.

Restrict integrations to the expected domain when the setup requires it.

Branding

Logo URL.

Associate an HTTP/HTTPS logo URL with compatible integrations.

Best practices

Best practices

  • Store secrets in environment variables or secret managers.
  • Don't send the Secret in JavaScript executed in the browser.
  • Separate sandbox/testing and production.
  • Plan key rotation without interrupting processing.
  • Record who changed credentials in internal environments.