Where to find it
Dashboard > Your Server > Commerce > API & Webhooks
Manage scoped credentials and signed commerce destinations.
Before you begin
- A server integration that needs Commerce access.
- A secure secret manager and an HTTPS webhook destination.
Use this page
- 1
Choose Generate key and copy the revealed secret immediately.
- 2
Store it securely; AioBot will not show it again.
- 3
Add an HTTPS outbound webhook destination if an external service should receive payment events.
- 4
Copy and store the webhook signing secret immediately, verify signatures in the receiving service, and revoke or delete unused credentials.
Reference
| Option | What it does |
|---|---|
| Generate key | Creates a key named Commerce API key with read_products, create_invoices, and read_orders scopes in the current UI. |
| One-time secret | The full API secret is revealed once; later rows show only a prefix and public identifier. |
| Key status | Active keys may be revoked. Revocation stops existing clients immediately; there is no regenerate-in-place action. |
| Webhook URL | HTTPS destination that receives the selected outbound events. |
| Webhook events | The current Add endpoint action creates a payment.completed subscription. |
| Signing secret | Returned once when the endpoint is created and used by the receiver to verify AioBot deliveries. |
| Delete endpoint | Stops future Commerce events to that destination. |
| Testing | The current page does not expose a send-test control. Verify with a test-mode payment event and receiver logs. |
| Security | Use the smallest exposed scopes, never place secrets in client code, verify signatures before processing, and revoke compromised keys. |
Important
Verify it is working
- Use the key from a server-side test client for one permitted operation.
- Confirm an operation outside the listed scopes is not treated as granted.
- Trigger a test-mode payment and verify the signed endpoint delivery before enabling production use.