# Find your API keys and portal key

> Where to find your Personal Access Token, API Secret Key and Portal Key in the merchant dashboard, what each one does, and how to keep them safe.
>
> Source: https://docs.bayarcash.com/api-keys/

To connect a website, shop plugin or app to Bayarcash, you need three things from the merchant dashboard: a Personal Access Token (PAT), an API Secret Key and a Portal Key.

> **Caution**
> Never share these keys, and never put them in a screenshot, chat message or public page. Anyone who has them can act on your Bayarcash account. If you show your screen to someone for help, hide the keys first.

## What each key does

Plugins and SDKs ask for these by name:

| Key | What it does | Where to find it |
|---|---|---|
| Personal Access Token (PAT) | Identifies your requests to Bayarcash | **Profile** → **Integration** |
| API Secret Key | Signs your requests and checks the replies (the checksum) | **Profile** → **Integration** |
| Portal Key | Says which portal receives the payment | **Portals** |

## Get your PAT and API Secret Key

Sign in to the [merchant dashboard](/sign-in/) first. Then:

1. At the top right of the merchant dashboard, choose **Profile**.
2. Choose **Integration**.
3. Copy your Personal Access Token (PAT) and your API Secret Key.

*(Screenshot: The Integration page with the Personal Access Token (PAT) and API Secret Key boxes highlighted, values hidden)*

## Get your Portal Key

Each portal has its own key. To copy it:

1. At the top left of the merchant dashboard, choose **Portals**.
2. Select the portal you want to use.
3. Copy its Portal Key.

*(Screenshot: The Portal Details window with the Portal Key row highlighted, value hidden)*

Need a new portal first? See [Create and use portals](/portals/).

## Sandbox and live keys

The sandbox merchant dashboard at [console.bayarcash-sandbox.com](https://console.bayarcash-sandbox.com) issues its own separate keys for testing. Use sandbox keys only while testing, and live keys only for real payments.

For API details, see the [Bayarcash API reference](https://api-reference.bayarcash.com).

## Common issues

### Why does my plugin say the token or key is invalid?

Sandbox and live keys are different. A key from the sandbox merchant dashboard does not work on the live merchant dashboard, and the other way round. Copy all three from the same merchant dashboard you are connecting to.

### Which key goes where?

The Personal Access Token (PAT) identifies you to Bayarcash. The Portal Key says which portal receives the payment. The API Secret Key is used for the checksum. Plugins and SDKs ask for each one by name.

### I shared a key by mistake. What now?

Contact Bayarcash straight away through the Need more help? box at the bottom of the page. Do not post the key again, even to ask for help.