> ## Documentation Index
> Fetch the complete documentation index at: https://requestnetwork-update-banner.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API Portal: Manage API Keys and Webhooks

> An app for managing Request Network API keys and webhooks.

<Frame>
  ![API Portal Screenshot](https://docs.request.network/~gitbook/image?url=https%3A%2F%2F1914277788-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252Fei6UAiSK3iAAi0mFH667%252Fuploads%252Fgit-blob-e66c8fd31d32271aa1fa5f42ba24d2052d598bdf%252FScreenshot%2520from%25202025-02-13%252016-25-12.png%3Falt%3Dmedia\&width=768\&dpr=4\&quality=100\&sign=f54d1873\&sv=2)
</Frame>

<CardGroup>
  <Card title="Try it out" href="https://portal.request.network" icon="joystick" horizontal />
</CardGroup>

## Overview

The Request Network API Portal provides app developers with a platform to securely manage their API keys and webhook endpoints.

## Key Features

### API Key Management

* **Create and Manage API Keys:** Users can create new API keys for authentication.
* **Toggle and Delete API Keys:** API keys can be toggled on and off, or deleted if no longer needed, enhancing control over API access.
* **Security Guidelines:** API keys are sensitive and should never be shared publicly. In case of compromise, users are advised to create a new key, update their code, and delete the compromised key.
* **Multiple Keys:** Allows the creation of multiple API keys for different environments or applications.

### Webhook Management

* **Create and Manage Webhooks:** App developers can configure webhook endpoints to receive real-time notifications for payment events.
* **Security Guidelines:** Each webhook request includes a signature in the \`x-request-network-signature\` header to ensure authenticity.
* **Signature Verification:** The signature is a SHA-256 HMAC of the request body, signed using the webhook secret.

Example Verification Code:

```bash expandable theme={null}
import express from 'express';
import crypto from 'node:crypto';

const app = express();
const WEBHOOK_SECRET = 'your_webhook_secret';

app.post('/payment', async (req, res) => {
  const signature = req.headers['x-request-network-signature'];
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex');

  // Timing-safe comparison to prevent timing attacks
  const signatureBuffer = Buffer.from(signature || '', 'utf8');
  const expectedBuffer = Buffer.from(expectedSignature, 'utf8');
  
  if (signatureBuffer.length !== expectedBuffer.length || 
      !crypto.timingSafeEqual(signatureBuffer, expectedBuffer)) {
    return res.status(401).json({
      success: false,
      message: 'Invalid signature'
    });
  }

  // Business logic here
  return res.status(200).json({ success: true });
});
```

## Usage

### Creating API Keys

* Navigate to the "API Keys" section.
* Click on "Create new key."
* Store the key securely and never share it publicly.

### Configuring Webhooks

* Navigate to the "Webhooks" section.
* Click on "Add webhook."
* Enter the endpoint URL and ensure the endpoint is secure and can handle incoming JSON payloads.

## Security Considerations

* **Keep API keys and webhook secrets secure.** Never expose them in public repositories or client-side code.
* **Verify all webhook signatures** to ensure authenticity and integrity.
* **Use HTTPS** for all endpoints to encrypt communication.