Profile & API key

Routes: /settings/account/profile (user) and /merchants/[id] API key tab (merchant).

User profile#

• Display name, email, password change (under Settings → Account → Security).

API key rotation#

• On the merchant detail page, open the API key tab.
• Click Rotate. Confirm.
• The new key is shown once. Copy it to your secret store.
• The old key invalidates immediately — coordinate with callers beforehand.

Webhook secret rotation#

• Same tab.
• Same model — shown once, old secret invalidates immediately.
• Deliveries signed with the old secret will fail signature verification on your side after rotation. Use Retry failed webhooks to redeliver under the new secret.

Screenshot placeholder.