> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mygigsters.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Restricted keys

> Create API keys that can only reach the modules an integration needs.

A restricted key is an API credential with module-level permissions. Use one for each application or integration so it can only reach the resources it needs, for example read access to Payments and no access to Customers.

## Permissions

Each permission pairs a `module` with a `permission_level`.

| Field | Values seen in examples |
| - | - |
| `module` | `Customers`, `Cards`, `Payment Intents`, `Payments`, `Workers`, `Payouts`, `Invoices`, `Subscriptions` |
| `permission_level` | `none`, `read` |

## Create a restricted key

`POST /api/v1/restricted-keys`

```bash Request theme={null}
curl -X POST https://qa-payments.mygigsters.com.au/api/v1/restricted-keys \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "My Limited Access Key",
  "permissions": [
    { "module": "Customers", "permission_level": "none" },
    { "module": "Payments", "permission_level": "read" }
  ]
}'
```

```json Response theme={null}
{
  "status": 201,
  "message": "Restricted API key created successfully.",
  "data": {
    "id": 1,
    "uuid": "810c5e37-b3f3-4a9f-bde9-1a95a5b2ce5d",
    "name": "My Limited Access Key",
    "secret_key": "NEW_SECRET_KEY"
  }
}
```

> [!WARNING]
>
> The `secret_key` is shown only once. Store it securely. It can't be retrieved or shown again.

## Retrieve a restricted key

`GET /api/v1/restricted-keys/{id}`

Returns the key's details and its permission for every module.

```bash Request theme={null}
curl -X GET https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1 \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2"
```

```json Response theme={null}
{
  "status": 200,
  "data": {
    "id": 1,
    "uuid": "810c5e37-b3f3-4a9f-bde9-1a95a5b2ce5d",
    "name": "Updated Marketing Key",
    "status": "Active",
    "created_at": "2026-07-24T07:41:22.000Z",
    "permissions": [
      { "module": "Customers", "permission_level": "read" },
      { "module": "Cards", "permission_level": "none" },
      { "module": "Payment Intents", "permission_level": "none" },
      { "module": "Payments", "permission_level": "none" },
      { "module": "Workers", "permission_level": "none" },
      { "module": "Payouts", "permission_level": "read" },
      { "module": "Invoices", "permission_level": "none" },
      { "module": "Subscriptions", "permission_level": "none" }
    ]
  }
}
```

## Update a restricted key

`PUT /api/v1/restricted-keys/{id}`

Updates the name or module permissions.

```bash Request theme={null}
curl -X PUT https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1 \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Updated Marketing Key",
  "permissions": [
    { "module": "Customers", "permission_level": "read" },
    { "module": "Payouts", "permission_level": "read" }
  ]
}'
```

```json Response theme={null}
{
  "status": 200,
  "message": "Restricted API key updated successfully."
}
```

## List restricted keys

`GET /api/v1/restricted-keys`

```bash Request theme={null}
curl -X GET https://qa-payments.mygigsters.com.au/api/v1/restricted-keys \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2"
```

```json Response theme={null}
{
  "status": 200,
  "pagination": {
    "current_page": 1,
    "page_size": 10,
    "total_count": 1,
    "total_pages": 1
  },
  "keys": [
    {
      "id": 1,
      "uuid": "810c5e37-b3f3-4a9f-bde9-1a95a5b2ce5d",
      "name": "Updated Marketing Key",
      "status": "Active",
      "created_at": "2026-07-24T07:41:22.000Z",
      "revoked_at": null
    }
  ]
}
```

## Delete a restricted key

`DELETE /api/v1/restricted-keys/{id}`

Deletes the key immediately. Any request using it stops working straight away.

```bash cURL theme={null}
curl -X DELETE https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1 \
  -u "YOUR_UUID:YOUR_SECRET" \
  -H "X-API-Version: 1.2"
```

```javascript Node.js theme={null}
const response = await fetch("https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1", {
  method: "DELETE",
  headers: {
    Authorization: "Basic " + Buffer.from("YOUR_UUID:YOUR_SECRET").toString("base64"),
    "X-API-Version": "1.2",
  },
});

const data = await response.json();
console.log(data);
```

```python Python theme={null}
import requests

response = requests.delete(
    "https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1",
    auth=("YOUR_UUID", "YOUR_SECRET"),
    headers={
        "X-API-Version": "1.2",
    },
)

print(response.json())
```

```ruby Ruby theme={null}
require "net/http"
require "json"
require "uri"

uri = URI("https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1")
request = Net::HTTP::Delete.new(uri)
request.basic_auth("YOUR_UUID", "YOUR_SECRET")
request["X-API-Version"] = "1.2"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end

puts JSON.parse(response.body)
```

```php PHP theme={null}
<?php

$ch = curl_init("https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1");

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "DELETE",
    CURLOPT_USERPWD => "YOUR_UUID:YOUR_SECRET",
    CURLOPT_HTTPHEADER => [
        "X-API-Version: 1.2",
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

print_r(json_decode($response, true));
```

```java Java theme={null}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.util.Base64;

public class Example {
    public static void main(String[] args) throws Exception {
        String credentials = Base64.getEncoder()
            .encodeToString("YOUR_UUID:YOUR_SECRET".getBytes());

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1"))
            .header("Authorization", "Basic " + credentials)
            .header("X-API-Version", "1.2")
            .method("DELETE", HttpRequest.BodyPublishers.noBody())
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.body());
    }
}
```

```go Go theme={null}
package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("DELETE", "https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1", nil)
	if err != nil {
		panic(err)
	}
	req.SetBasicAuth("YOUR_UUID", "YOUR_SECRET")
	req.Header.Set("X-API-Version", "1.2")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	data, _ := io.ReadAll(res.Body)
	fmt.Println(string(data))
}
```

```csharp .NET theme={null}
using System.Net.Http.Headers;
using System.Text;

using var client = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Delete, "https://qa-payments.mygigsters.com.au/api/v1/restricted-keys/1");
request.Headers.Authorization = new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes("YOUR_UUID:YOUR_SECRET")));
request.Headers.Add("X-API-Version", "1.2");

var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.