API keys

API keys authenticate your API requests to Vipps MobilePay.

What are API keys

API keys is the umbrella term for all of these:

Key type	Description
Sales unit keys	Standard API keys provided to a merchant, allowing access to their sales unit. Each sales unit has its own separate set. Often just called "API keys", and called merchant keys in older documentation. Used by merchants and sometimes by partners acting on a merchant's behalf.
Partner keys	Elevated API keys provided to large partners, allowing access to all their merchants' sales units. Used by partners acting on behalf of all their merchants.
Accounting keys	Specialty keys provided to accounting partners, giving them access to the Report API for one of their merchants' sales units.
Merchant-level keys	Specialty keys provided to Donations product users, allowing them to review their donations proceeds.

Which type of keys do I use?

• I am a small or medium-sized merchant — you have sales unit keys, one set for each of your sales units.
• I am a partner acting on behalf of several merchants — you have partner keys. If you handle accounting, you have accounting keys instead, or as well.
• I work with donations — you have merchant-level keys or partner keys.

Getting the API keys

The key type you need — and how you get it — depends on your role:

Merchants

You will use sales unit API keys. Each sales unit has its own separate set.

Log in to the business portal and follow these steps:

1. Click For developers in the sidebar. You should see a list of sales units. Select Test or Production.

2. Find your sales unit and click Show keys. A panel opens where you can copy each key value.

3. Also copy the Merchant Serial Number (MSN) — you will need it in API requests.

   

   Screenshot: API keys panel for sales unit showing four key fields: client_id, client_secret, Ocp-Apim-Subscription-Key (primary), and Ocp-Apim-Subscription-Key (secondary). Each has a Regenerate button. A note explains the primary and secondary keys are interchangeable.

If you accidentally expose your API keys, regenerate them immediately.

For more information, see about the business portal.

Partners

You will usually use your Partner keys — see API keys for partners.

Accounting partners will use Accounting keys for access to the Report API only.

Partners may occasionally use a merchant's own sales unit keys on behalf of that single merchant.

If you can't use partner keys, you have two options:

1. Ask the merchant to securely send their keys to you.
2. If the merchant can't share keys securely, they can add a portal user for you with Assistant access, so you can log in and retrieve the keys yourself.

If you compromise your partner keys, contact the partner team immediately.

Donations

You will use merchant-level keys. These belong to the business as a whole rather than to a single sales unit.

See merchant-level keys for details on how to find these.

Production and test keys

As a merchant, you will need two separate sets of keys — one for testing and one for production. Each set is tied to a specific sales unit and can only be used for that unit. If you have multiple sales units, you will have a separate set of keys for each one.

• Test environment: Keys are normally available a few minutes after the sales unit is created. See How to create a test sales unit for details.
• Production environment: Keys are normally available a few days after application, depending on workload and whether we need additional information.

Keep your API keys secret

API keys are sensitive information, so handle them carefully:

• Vipps MobilePay will never ask for your API keys.
• If you need to share keys with a colleague, always use encrypted email or a secure secret manager. If keys can't be moved securely, you can create a portal user for that person and give them basic access to the sales unit.
• If you accidentally expose your API keys, regenerate them immediately:
  • Merchants: Click the Regenerate button on your sales unit page in the business portal. See How to regenerate API keys for step-by-step instructions.
  • Partners: For partner-level keys, contact the partner team. For a merchant's sales unit keys, the merchant must regenerate them via the business portal.
• Update your integrations after regenerating keys so they continue to work.

API key details

The key names you receive depend on which authentication method your key type uses.

Sales unit keys and partner keys (standard authentication) include four values:

API Key Name	Description	Format	Example
client_id	Client ID for the sales unit (the "username")	GUID	00000000-0000-0000-0000-000000000000
client_secret	Client secret for the sales unit (the "password")	Base64	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
Ocp-Apim-Subscription-Key (primary)	Subscription key for the API product	Hex	00000000000000000000000000000000
Ocp-Apim-Subscription-Key (secondary)	Interchangeable with the primary key	Hex	00000000000000000000000000000000

The primary and secondary Ocp-Apim-Subscription-Key values are interchangeable. Having two lets you rotate one without downtime while the other remains active.

Accounting keys and Donations merchant-level keys (specialized authentication) use only client_id and client_secret — there is no subscription key.

You use client_id and client_secret with the Access Token API to get an access token for subsequent API requests.

The same sales unit keys work across all integration types — direct API, mobile apps, point of sale, and plugins.

tip

The Merchant Serial Number (MSN) is not an API key, but you will need it in many API requests. You can find it in the same place as your API keys in the business portal.

Related pages

• Partners: See API keys for partners for the full overview of partner key types.