Skip to main content
Create a key, copy it once, use it to call the Moove API.
Web only, at moove.xyz/dashboard/api-keys. There is no mobile equivalent.

​
How Do I Create An API Key?

1

Open Manage → API Keys

On the web dashboard.
2

Name it

Something you will recognise in six months — the service or environment it is for.
3

Pick an agent

Moove Receive Agent is the one that exists. It expands to the scopes that agent needs.
4

Copy the key

The plaintext key is shown once, at creation. Copy it now and store it in your secret manager. Close the dialog without copying and the key is unusable — create another.
The base URL is https://api.moove.xyz.

​
Moove Agents, Not Raw Scopes

You pick an agent, not a permission string. “Moove Receive Agent” is the unit a merchant can reason about; payment_link:create is not. The three coming-soon agents appear disabled. Selecting one would mint a key that grants nothing, so the picker does not let you.

​
What An API Key Can & Cannot Do

A key is a down-scope of you. It acts as your account and can only do a subset of what you can do.No endpoint moves funds. A payment link always settles to your own default wallet, in that wallet’s token — the caller cannot specify a destination. A leaked key can create requests that pay you. It cannot pay anybody else.
A key also cannot mint another key. Key management is session-authenticated only, so a compromised key cannot escalate itself.

​
How Do I Keep A Key Safe?

  • Store it in a secret manager or an environment variable. Never in source control.
  • Never paste it into a prompt, a chat, an issue or a screenshot.
  • Use a separate key per service, so revoking one does not take down the rest.
  • Revoke any key you are unsure about. Creating a new one takes seconds.

​
How Many Keys Can I Have?

Up to 10 active keys per account. Create an eleventh and the request is refused with TOO_MANY_API_KEYS — revoke one you are no longer using first.
The ceiling is a reason to scope keys per integration rather than per deploy. One key per service you actually run is easier to reason about, and easier to revoke when something changes.

​
How Do I Revoke A Key?

1

Open the key's menu

In Manage → API Keys, open the … menu on the key’s row and choose Revoke.
2

Confirm

Click Revoke again to confirm. The key stops working immediately.
Revocation is permanent. There is no un-revoke. The plaintext was never stored, so a revoked key could never be used again even if the record were restored. Issue a new key instead.

​
How Do I Use A Key?

Send it in the X-API-Key header on every request.
Authentication →

​
Before Your First Call

The API refuses to create links for an account that cannot receive payments. Make sure you have claimed a Moove Handle and set a default wallet with a settlement token — otherwise you will get a 409.

Authentication

How the header works.

Moove Agentic Payments

Let an AI tool do the integration.

Moove Payment Links API

The endpoints in full.
Scoped, revocable, yours. Your Money. Your Move.