Create merchant API keys
Provision separate private payment and public tokenization credentials.
Confirm partner access
Requires authorized merchant-management access and the gateway ID returned when the merchant was created. An ordinary merchant payment key does not establish provisioning access. Partner administration recipe. Confirm sandbox partner permissions before executing. Never call this endpoint from a browser.
Create the private key
Choose the merchant user explicitly. The transaction permission is for private payment access; store the resulting credential in your secret manager. POST /api/v4/merchants/<gateway-id>/security_keys HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-partner-key> Content-Type: application/json { "userId": "<merchant-user-id>", "description": "Application payment access", "permissions": [ "transaction" ] }
Create the public key
Create a separate tokenization key for the same merchant. Only this public key belongs in frontend configuration. POST /api/v4/merchants/<gateway-id>/security_keys HTTP/1.1 Host: sandbox.nmi.com Authorization: <sandbox-partner-key> Content-Type: application/json { "userId": "<merchant-user-id>", "description": "Checkout tokenization", "permissions": [ "tokenization" ] }
Verify the boundary
Confirm both keys belong to the intended test merchant. Test tokenization and server payment access separately. Redact credential values from logs and support messages.