API Credentials

Protected Wallet APIs use two credentials issued by BPMG:

Credential	Purpose	Sent with requests
API Key	Identifies the client integration	Yes, as X-API-KEY
HMAC Key	Signs request content	No; only the derived signature is sent

Credentials belong to one client and environment. Never reuse a test credential in production.

Storage rules

• Keep credentials in a server-side secret manager.
• Never embed them in a browser, mobile app, Git repository, container image, or support ticket.
• Redact authentication headers and request bodies from logs where they may contain sensitive data.
• Restrict secret access to the service process that signs requests.
• Rotate credentials through the agreed onboarding process and support overlapping rollout only when explicitly provided.

Expose your own authenticated backend endpoint to customer applications. The backend authorizes the customer action and signs the corresponding OOLIN request.

If authentication fails, branch on error.code and error.action. Do not repeatedly retry an invalid key or signature.

Rotation procedure

Prepare rotation without exposing either key: deploy support for the new credential, switch the active secret reference, verify one signed read request, and then revoke the previous credential through the agreed process. If overlapping credentials are not explicitly supported, coordinate a controlled cutover instead of assuming both keys remain valid.

Logging boundary

It is safe to log the endpoint template, HTTP status, request_id, stable error code, and an internal credential alias. Do not log the HMAC key, API key, signature, complete signed string, or a request body containing customer data.

Credential compromise is not a retryable API error. Stop affected traffic, rotate the material, review request logs by safe credential alias and occurrence time, and contact the onboarding support channel.