How to generate terminal tokens in QryptoPay
In QryptoPay, you can issue a new pair of terminal tokens — private and public — at any time. This is a key part of your payment security: your shop's website and the server running QryptoPay use them to verify that payment intents and payment status responses haven't been tampered with.
Each merchant has two terminals — "Test terminal" and "Production terminal" (see the QryptoPay setup guide for details) — and each has its own independent token pair.
Private and public tokens
- Private token — a secret key. Your shop's website uses it to sign the payment token that QryptoPay uses to build the payment link. Keep it on the server only, never in your site's code.
- Public token — stored on QryptoPay's side and used to verify that signature. A public token alone isn't enough to forge a signature and create a payment on your behalf, but there's still no reason to expose it unnecessarily.
When to generate tokens
- Initial setup. Until a token pair is generated for a terminal, it can't build payment links, and so can't accept payments.
- Compromise or loss. The private token isn't stored on QryptoPay's side — if it becomes known to someone else, or you didn't manage to save it, generating a new pair is the only way to restore operation.
- Moving servers or reimplementing the signing logic. Migrating the integration to a new server is a good reason to reissue tokens and update them in your project settings.
- Scheduled credential rotation.
‼️ This action is irreversible
Once generated, the previous tokens are invalidated immediately. Until you update the private and public tokens in your project settings, this terminal can't accept payments — only generate a new pair when you're ready to update it on your side right away.
How to generate tokens
- Open the merchant and find the card for the terminal you need.
- Click the key icon with the "Generate tokens" tooltip. The icon is visible only to users with the "Edit terminal tokens" permission.
- In the "Generate tokens for terminal" dialog, click "Generate".
- QryptoPay shows the "Private token" — copy it with the button next to the field.
- Click "I have copied it" to close the dialog.
⚠️ The token is shown only once
The private token isn't stored anywhere on QryptoPay's side — you can't see it again. If you close the dialog without copying the token, you'll have to generate a new pair from scratch.
💡 Keep the private token on the server
The private token is only needed by your project's server side — for signing payment tokens. Never send it to the browser or store it in client-side site code.