> ## Documentation Index
> Fetch the complete documentation index at: https://docs.moove.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Moove API Keys

> Create a scoped API key for the Moove API, copy it once, and revoke it permanently when you are done.

Create a key, copy it once, use it to call the Moove API.

<Info>
  **Web only**, at [moove.xyz/dashboard/api-keys](https://www.moove.xyz/dashboard/api-keys). There is no mobile equivalent.
</Info>

## How Do I Create An API Key?

<Steps>
  <Step title="Open Manage → API Keys">
    On the web dashboard.
  </Step>

  <Step title="Name it">
    Something you will recognise in six months — the service or environment it is for.
  </Step>

  <Step title="Pick an agent">
    **Moove Receive Agent** is the one that exists. It expands to the scopes that agent needs.
  </Step>

  <Step title="Copy the key">
    <Warning>
      The plaintext key is shown **once**, at creation. Copy it now and store it in your secret manager. Close the dialog without copying and the key is unusable — create another.
    </Warning>
  </Step>
</Steps>

The base URL is `https://api.moove.xyz`.

## Moove Agents, Not Raw Scopes

You pick an **agent**, not a permission string. "Moove Receive Agent" is the unit a merchant can reason about; `payment_link:create` is not.

| Agent                   | Status      | Scopes it grants                           |
| ----------------------- | ----------- | ------------------------------------------ |
| **Moove Receive Agent** | **Live**    | `payment_link:create`, `payment_link:read` |
| Moove Send Agent        | Coming soon | —                                          |
| Moove Swap Agent        | Coming soon | —                                          |
| Moove Ramp Agent        | Coming soon | —                                          |

The three coming-soon agents appear disabled. Selecting one would mint a key that grants nothing, so the picker does not let you.

## What An API Key Can & Cannot Do

<Note>
  A key is a **down-scope of you**. It acts as your account and can only do a subset of what you can do.

  **No endpoint moves funds.** A payment link always settles to your own default wallet, in that wallet's token — the caller cannot specify a destination. A leaked key can create requests that pay *you*. It cannot pay anybody else.
</Note>

A key also cannot mint another key. Key management is session-authenticated only, so a compromised key cannot escalate itself.

## How Do I Keep A Key Safe?

<Warning>
  * Store it in a secret manager or an environment variable. Never in source control.
  * Never paste it into a prompt, a chat, an issue or a screenshot.
  * Use a separate key per service, so revoking one does not take down the rest.
  * Revoke any key you are unsure about. Creating a new one takes seconds.
</Warning>

## How Many Keys Can I Have?

Up to **10 active keys** per account. Create an eleventh and the request is refused with `TOO_MANY_API_KEYS` — revoke one you are no longer using first.

<Tip>
  The ceiling is a reason to scope keys per integration rather than per deploy. One key per service you actually run is easier to reason about, and easier to revoke when something changes.
</Tip>

## How Do I Revoke A Key?

<Steps>
  <Step title="Open the key's menu">
    In **Manage → API Keys**, open the **…** menu on the key's row and choose **Revoke**.
  </Step>

  <Step title="Confirm">
    Click **Revoke** again to confirm. The key stops working immediately.
  </Step>
</Steps>

<Warning>
  **Revocation is permanent.** There is no un-revoke. The plaintext was never stored, so a revoked key could never be used again even if the record were restored. Issue a new key instead.
</Warning>

## How Do I Use A Key?

Send it in the `X-API-Key` header on every request.

```bash theme={null}
curl -sS -X POST "https://api.moove.xyz/v1/payment-link" \
  -H "X-API-Key: $MOOVE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "toAmount": "49.99" }'
```

[Authentication →](/api-reference/authentication)

## Before Your First Call

The API refuses to create links for an account that cannot receive payments. Make sure you have claimed a [Moove Handle](/brand/moove-handle) and set a default wallet with a [settlement token](/concepts/settlement-and-auto-routing) — otherwise you will get a `409`.

## What To Read Next

<CardGroup cols={3}>
  <Card title="Authentication" icon="lock" href="/api-reference/authentication">
    How the header works.
  </Card>

  <Card title="Moove Agentic Payments" icon="sparkles" href="/transact/moove-agentic-payments">
    Let an AI tool do the integration.
  </Card>

  <Card title="Moove Payment Links API" icon="link" href="/api-reference/moove-receive/moove-payment-links">
    The endpoints in full.
  </Card>
</CardGroup>

Scoped, revocable, yours. Your Money. Your Move.