API Credentials
API credentials are what a merchant must obtain before calling the open API: the platform public key, merchant public key and communication key trio, plus the domain verification file required by WeChat JS payments. Menu path: Merchant Center → Business Config → API Credentials / Domain Verification File.
API credentials are merchant-level configuration (one set per merchant, not per app); for app-level configuration see App Payment Config.
The Three Credentials
| Credential | Purpose | Page behavior |
|---|---|---|
| Platform public key | Given to you for verifying the signatures of platform responses and callbacks (confirming the message really comes from the platform) | Read-only display, copyable |
| Merchant public key | You hold the paired private key and configure the public key on the platform, so the platform can verify your request signatures | Editable, supports online "Generate key pair" |
| Communication key | AES symmetric key used for encrypted transport of API messages | Masked display, editable, supports online "Generate key" |
For how the three credentials participate in signing and encryption, see Signature Mechanism; SDKs have the whole flow built in — see Getting Started.
Online Generation and Rotation
If you don't have keys at hand, you can generate them directly on the page — no local tooling required:
- Generate key pair (RSA): after generation, the private key is shown only once in a dialog and cannot be recovered once closed — copy and store it immediately. Regenerating when a public key already exists overwrites the original key and requires confirmation;
- Generate key (AES): regenerates the communication key; same confirmation when a value already exists.
Knock-on effects of rotation
After replacing the merchant public key or the communication key, every caller still on the old key (business systems, SDK instances) will fail signature verification / decryption. Before rotating, confirm that all integrators have switched to the new key, then save.
Only modified fields are submitted on save: the communication key is masked on the page; leaving it untouched does not overwrite the real value on the server — don't panic at the mask, it does not mean the key is lost.
Domain Verification File
WeChat JSAPI / mini-program payments require a verification file under the collecting domain (an MP_verify_xxxx.txt downloaded from the WeChat Official Account Platform). Menu path: Merchant Center → Business Config → Domain Verification File.
- Click "Upload verification file" and pick the txt file downloaded from WeChat; only names starting with
MP_verify_are accepted — other file names are rejected outright; - After upload, the system hosts the file and serves it; the list is searchable by file name and verification code;
- Editing can only change the remark; the file name and content are immutable — if you uploaded the wrong one, delete and re-upload.
The admin panel can manage the same data on your behalf (Merchant Management → Merchant Workbench → Business Config); changes on either side take effect immediately.
Related Links
- Getting Started — fire your first request with the three credentials
- Signature Mechanism — algorithm details of the key pair and communication key
- Business System Integration — the full integration walkthrough and common error reference
- Merchant Management (admin panel) — credentials from the admin-side proxy-management perspective