Update a Processor Key
Rename a key, change its payment types, make it the default, or replace the key itself
Update a Processor Key
Send only the fields you want to change. At least one is required.merchant_ref is not accepted — see Tags cannot change.
Make a key the default
Promoting a key (is_default: true) swaps it with the current default for the same rail_scope, if there is one. That key becomes an ordinary untagged key; nothing else about it changes.
Only untagged keys can be promoted. A tagged key is reached by naming its tag, and making it the default would send untagged borrowers to a merchant account you set aside for tagged ones — the request is rejected with 400. To serve borrowers enrolled without a tag, add or promote an untagged key.
Demoting (is_default: false) needs no replacement. A payment type the demoted key covered falls back to a default both key if you have one; only when no other default covers it are borrowers enrolled without a tag skipped on that type, until you set a new default — GET /v1/payment_connections shows any gap in missing_default_rails.
Replace a key
To rotate credentials, send the newapi_key on its own. The label, tag and payment types stay as they are, key_last4 changes, and the previous key is revoked as soon as the new one is stored. If the new key cannot be stored, the previous one stays in place.
Tags cannot change
merchant_ref is fixed when the key is added. Borrowers already enrolled under a tag would silently move to a different merchant account if it could change, so a request that includes merchant_ref is rejected with 400.
When a request is rejected
Authorizations
Authentication to the API is performed via Bearer Token Authentication. Provide your API key as the bearer token in the Authorization header.
All API requests must be made over HTTPS. Calls made over plain HTTP will fail. API requests without authentication will also fail.
Path Parameters
The key's id, as returned when it was added or listed.
Body
Send only the fields to change. At least one is required. merchant_ref is
not accepted — a tag is fixed when the key is added.
A new name for the key.
1 - 80The payment types this key can take. A default key cannot move onto a
rail_scope that already has a default, and a tagged key cannot move
onto one its tag already has a key for.
ach, card, both true promotes an untagged key to default for its rail_scope, swapping
with the current default for that scope if there is one. false
demotes it and leaves the scope without a default.
A replacement key from your processor. The previous key is revoked once this one is stored; if it cannot be stored, the previous key stays in place.
1Response
The key as it is now.
One registered key. Never includes the key itself.
Use this to update or delete the key.
The name you gave the key.
The tag enrollments name to settle to this key, or null for a
default or unused key.
The payment types this key can take.
ach, card, both Whether this is the default key for its rail_scope.
The last four characters of the stored key, to tell keys apart.
When Rightfoot last read payment results through this key. null
until the first read.
Reserved for a future permissions setting. Always lender_admins today.
When the key was added.