Payments Access
5 min
payments has two access models today ui access is team wide, while api key access is environment scoped payments ui access payments ui permissions follow the user's team permission read view wallets, balances, payments, and related resources across payments environments write create/manage wallets, create api keys, and send/receive payments across all payments environments in the team team management manage users and permissions billing manage billing related settings and information current limitation ui write cannot be limited to only staging or only production within one team today environment scoped payments ui/jwt user access is tracked internally as dev 2322 payments api key access payments api keys are scoped to one environment and sent with the x api key header read view resources in that environment write create/manage wallets, create payments, and manage other writable resources in that environment billing access billing or line of credit api operations where supported create separate keys for staging and production recommended pattern development to production during development, you can optionally give developers team write so they can create api keys, create/manage wallets, and monitor balances in the ui before production go live, revoke developer team write and issue production api keys with the exact environment scoped permissions each service needs if developers need ongoing ui write in staging after production is live, use a separate team boundary for staging vs production until environment scoped ui permissions are available production key hygiene use separate keys per service use descriptive names that include the environment and purpose apply least privilege restrict production keys by ip when possible store keys in a secrets manager or environment variables rotate keys when team membership or service ownership changes ip allowlisting restrict api key usage to specific ip addresses or ranges where possible leave the ip allowlist blank only when the key must be usable from any ip address webhook secrets webhook shared secrets are separate from api keys store them securely and validate webhook signatures before processing events api reference base url https //voltageapi com/v1 full openapi specification https //voltageapi com/v1/docs
