Vue d’ensemble de l'onglet "Gestion des clés"
Accès à la page de gestion des clés
Depuis le Portail Marchand Axepta Online, accédez à la section Gestion des clés. La page affiche les informations suivantes :
- le commerçant sélectionné ;
- les données d’accès disponibles ;
- les clés principales et secondaires ;
- les actions possibles sur chaque clé ;
- l’historique des dernières activités.
Remarque : selon votre profil utilisateur, la section de gestion des clés peut ne pas être visible.
En haut à droite de l’écran, le champ Commerçant permet de sélectionner le compte marchand concerné. Avant toute opération, vérifiez que le bon commerçant est sélectionné. |
Données d’accès disponibles
La section Données d’accès contient les éléments techniques nécessaires à l’intégration.
Selon la configuration du compte, les éléments suivants peuvent être affichés :
Élément | Description | Usage principal |
Mot de passe de cryptage | Mot de passe utilisé dans certains modes d’intégration historiques ou spécifiques | Chiffrement ou sécurisation de certains échanges |
Clé HMAC principale | Clé HMAC active principale | Signature ou vérification de messages |
Clé API REST principale | Clé principale utilisée pour les appels API REST | Appels API REST en production ou en test |
Clé HMAC secondaire | Clé HMAC secondaire | Rotation de clé ou double run |
Clé API REST secondaire | Clé secondaire utilisée pour les appels API REST | Rotation de clé ou double run |
Les valeurs des clés sont masquées par défaut. Une icône d’affichage permet de visualiser temporairement une clé si votre profil y est autorisé. Une icône de copie est également disponible pour copier la valeur dans le presse-papiers.
- Display icon
: temporarily reveals the hidden value of the key.
- Copy icon
: copies the key to the clipboard for immediate use.
- Action button
: action menu on the keys.
Available actions
Each key line includes an action menu available from the icon on the right side of the relevant field.
Available actions may include :
Action | Description | Effect |
Create | Generates a key when the field is empty | The new key can be used immediately |
Renew | Generates a new value for an existing key | The previous value is replaced |
Revoke | Disables and deletes the key | The key can no longer be used |
Key revocation is immediate. Once revoked, the key must no longer be considered usable by your system. |
Renewing a primary REST API key
Use this procedure when you need to replace the primary REST API key.
Steps
- Log in to the Axepta Online Merchant Portal.
- Open the Key Management section.
- Make sure the correct Merchant is selected.
- In the Access data section, identify the Primary REST API key line.
- Click the action menu on the right side of the key.
- Select Renew primary REST API key.
- Confirm the action when a confirmation message is displayed.
- Display or copy the new key.
- Update your configuration.
- Test REST API calls with the new key.
- Check that the expected transactions or technical operations work correctly.
Zero-downtime rotation with secondary keys
For REST API integrations, Axepta Online may allow two sets of keys to be used in parallel : a primary key and a secondary key.
This feature is especially useful for rotating keys without service interruption.
Principle
The primary key remains used by the existing system while the secondary key is created or renewed.
The integrator then updates the application to use the new secondary key.
Once the new key has been validated, the old key can be revoked or renewed according to the defined strategy.
Recommended procedure
- Check which key is currently used by your system.
- Create or renew the secondary key.
- Configure your system to use this new key.
- Deploy the configuration.
- Perform technical tests:
- simple REST API call;
- transaction creation or retrieval;
- notification or webhook validation, if applicable;
- application log review.
- Monitor transactions.
- Once the new key is confirmed as operational, revoke the old key that is no longer required.
This approach reduces the risk of interruption because the old key remains available during the switch-over phase.
Revoking a REST API key
Revocation disables an existing key. It should only be used when you are sure the key is no longer used, or when compromise is suspected.
Steps
- Log in to the Axepta Online Merchant Portal.
- Open Key Management.
- Select the correct Merchant.
- Identify the key to revoke.
- Click the key action menu.
- Select Revoke.
- Confirm the operation.
- Check the activity history to confirm that the action was recorded.
- Make sure your system no longer use this key.
Important: a revoked key must no longer be used in your system. If the system continues to use a revoked key, the related API calls may fail.
Renewing an HMAC key
The HMAC key is used to sign or verify certain technical exchanges, especially when the integration relies on signature mechanisms.
Steps
- Open the Key Management section.
- Identify the Primary HMAC key or Secondary HMAC key.
- Open the action menu.
- Select the renewal action.
- Update your application configuration.
- Check that signatures generated or verified by your system remain valid.
- Review application logs and any authentication errors.
Latest activity history
The Latest activities section displays operations performed on keys.
It allows you to view:
- the action or creation date;
- the type of action performed;
- the key concerned;
- the operation details;
- the user who performed the action;
- the merchant concerned.
This section is useful for audit tracking, traceability and incident analysis.
Examples of visible actions:
- key viewed;
- key renewed;
- key revoked;
- encryption password viewed.
Export & Security
- Keys cannot be exported as a file,
- For security reasons, keys are hidden by default.