Skip to content
CowriePay API

Create your account and get your keys

Everything in this documentation assumes you hold an API key. This page is where it comes from. No sales call, no review queue: signing up is self-service and lands you in the Sandbox.

Sign up

Section titled “Sign up”

Go to app.cowriepay.io/signup. The form asks for your email, your name, and the name of your business. It also asks you to accept the contractual documents (each one named with its version, each a link you can read before ticking) and to confirm you are signing up for professional purposes and not as a consumer; a separate marketing opt-in is optional and never pre-ticked. A review screen then shows what you entered, and you confirm once.

CowriePay is for businesses rather than consumers, and that turns on how you use it, not on what legal form you have: a duly registered sole trader or freelancer qualifies exactly as a company does.

There is no password field, on purpose: the password is set after you click the activation link we email you, so nothing about your account exists until you have proved you control the address.

If the email does not arrive within a couple of minutes, check your spam folder, then use the resend link on the confirmation screen. The resend exists for a reason; use it rather than signing up again.

Activate, and save your key

Section titled “Activate, and save your key”

Clicking the activation link asks you to set a password, then activates your workspace. If you are the workspace owner, activation also issues your first Sandbox API key (cpk_test_ prefix).

The secret is shown once, at that moment, and is never retrievable again. Store the key and the secret in your secret manager before leaving the page. If you lose the secret, you do not recover it: you mint a new key from the dashboard and revoke the old one.

The bootstrap key carries exactly the scopes the Quickstart needs: wallets:read and wallets:write, transactions:read, webhooks:read and webhooks:write, customers:read and customers:write. Two families are deliberately absent:

  • api_keys:*: a key that can mint keys makes a leak self-renewing; revoking it would no longer end a compromise. Mint keys from the dashboard instead.
  • withdrawals:*: the withdrawal path carries security controls (allowlist, approval) that the Sandbox flow would not teach you. See Going live for how withdrawals actually behave in production.

Mint further keys from the dashboard

Section titled “Mint further keys from the dashboard”

The Developer page of the dashboard creates additional keys, and it is where you shape access:

  • Scopes: give each integration only the scopes it uses (resource:action, catalogue on Create an API key in the API reference).
  • Network: a key is either Sandbox (cpk_test_) or Live (cpk_live_); Live keys exist only once your workspace is live.
  • IP allowlist (optional): restrict the key to your servers’ addresses.
  • Expiry (optional): time-box a key you hand to a contractor or a test rig.

Revocation is immediate. The same one-time rule applies to every key: the secret appears at creation and never again.

One account, one self-service workspace

Section titled “One account, one self-service workspace”

An email address can create one self-service workspace. If you later need access to other workspaces (an agency working for several clients, for instance), you join them by invitation, and there is no limit on invitations. Your login stays one identity across all of them, and the dashboard lets you switch workspace.

What next

Section titled “What next”