API keys
The life cycle of a key on Platform, for Merchant API and Transaction Intelligence: opening the sandbox, creating a key, copying the secret once, replacing and revoking.
All keys are managed on the Clés d'API (API keys) page, which has one section per product. The two families are separate: a Merchant API key (nry_mer_…) does not open Transaction Intelligence, and a Transaction Intelligence key (nry_txn_…) does not open Merchant API. No API route creates or revokes a key: it is done here.
The two families side by side
| Merchant API | Transaction Intelligence | |
|---|---|---|
| Form of a sandbox key | nry_mer_sbx_<key_id>.<secret> | nry_txn_sbx_<key_id>.<secret> |
| Before the first key | Noryo must have opened the issuing of Merchant API sandbox keys | A complete developer profile, then the sandbox enabled by an owner or an admin |
| Who creates and revokes | Any member of the organisation | owner, admin, developer |
| What you choose at creation | A name and the scopes enrich:read, enrich:write (both by default) | A name |
| Cap on active keys | None | Yes: the cap and the current count are shown, read from the server; revoked keys do not count |
| Production key | Never created on Platform | nry_txn_live_…, on the Production Transaction Intelligence page, once every condition is met |
Before the first key
Merchant API. There is nothing to enable on your side. Until Noryo has opened the issuing of Merchant API sandbox keys, a banner says so and the server refuses creation with the message Sandbox access is not enabled yet.. The button deliberately stays clickable: the server decides, and the page shows its refusal.
Transaction Intelligence. First complete the workspace's developer profile. An owner or an admin then clicks Activer le sandbox Transaction Intelligence (enable the Transaction Intelligence sandbox). Enabling it is a workspace decision, logged, with no intervention from Noryo: it creates nothing but the right to issue nry_txn_sbx_ keys. Other roles see the sandbox's state, and the page tells them that an owner or an admin can enable it.
1. Create a key
In the product's section, give the key a name, which is there to help you find it, and, for Merchant API, tick the scopes. Click Créer la clé (create the key) for Merchant API or Créer une clé Sandbox (create a sandbox key) for Transaction Intelligence.
On the Transaction Intelligence side, each form carries a unique intent: a double click or a browser replay presents the same request, which the server refuses the second time. There are never two keys for a single request.
2. Copy the secret, once
The full secret is shown once, with a Copier (copy) button. Noryo keeps only a verifier and cannot give it back to you: a reloaded page no longer knows it. On the Transaction Intelligence side, the page also offers a first curl call ready to paste, built with that secret.
Store it server-side, in an environment variable or a secrets manager, never in a browser, a code repository or a mobile app. See Secret security.
If the page answers that this request has already been served, a key was indeed created but its response was lost on the way. Its secret cannot be recovered: revoke the key that appeared in the list and create another one.
3. Read the list
Each section lists the workspace's keys, revoked ones included: the name, what identifies the key (its prefix and public identifier, never the secret), the creation date, the last use and the state; on the Merchant API side, the scopes too, and on the Transaction Intelligence side, the environment. Transaction Intelligence dates are in UTC.
The "last used" value of a Transaction Intelligence key is updated at most once per window and per key, at a pace set by the server and stated under the list: it is an indication, not a per-request timestamp. Request details are on the Usage page. See Usage.
4. Revoke a key
Click Révoquer (revoke) next to the key. Revocation is immediate and final: from the next request, the key is refused with a 401, and nothing is counted for it any more. It stays in the list, as revoked, with its usage history. Platform offers no way to reactivate it.
Revoking a Transaction Intelligence key requires the owner, admin or developer role; a Merchant API key can be revoked by any member. If the workspace or its organisation is not active, no Transaction Intelligence key can be issued or revoked from Platform.
Replacing a key
There is no rotation, neither a button nor a route. You replace a key with two visible actions, each of which leaves a trace:
- Create a new key in the same workspace.
- Deploy it in place of the old one.
- Check in the list that the new key is being used and the old one no longer is.
- Revoke the old one.
Several active keys can coexist, which lets you switch keys without interruption. On the Transaction Intelligence side, if the cap is reached, revoke an unused key before creating one. See Rotation and Revocation.
Further reading
- Merchant API keys: the anatomy of a key, scopes, what a workspace's keys share.
- Transaction Intelligence usage and API keys: the Transaction Intelligence section in detail.
- Production access: when a production key can exist.
Published on 2026-10-09 10:17 UTC (version 1).