Articles on: Business Settings

How to Find Xendit API Keys and Webhook Verification Token

How to Find Xendit API Keys and Webhook Verification Token


To connect Xendit to your restaurant dashboard, you may need your Public API Key, Secret API Key, and Webhook Verification Token. Follow the steps below to locate or generate these credentials.


1. Log In to Xendit


  1. Open the Xendit Dashboard.
  2. Log in using your Xendit account.
  3. Make sure you have permission to access the API and webhook settings.




2. Find Your Public API Key


  1. Navigate to Settings → API Keys.
  2. Select the appropriate environment: Test or Live.
  3. Locate the Public Key section.
  4. Copy the public key and store it securely.


Public keys are intended for client-side use and commonly begin with xnd_public.


3. Generate Your Secret API Key


  1. In the Secret API Keys section, click Generate Secret Key.
  2. Enter a recognizable name for the key.
  3. Select the required permissions for your integration.
  4. Choose the appropriate environment.
  5. Complete the generation process.
  6. Copy and securely store the Secret API Key immediately.


Important: Your Secret API Key may only be displayed when it is generated. If you lose it, you may need to generate a replacement and update your integration.



4. Find Your Webhook Verification Token


The webhook verification token is used to verify webhook notifications received from Xendit. It is different from your Public API Key and Secret API Key.


  1. Open the Webhooks section in your Xendit Dashboard.
  2. Select your existing webhook configuration or create one if required.
  3. Review the webhook configuration for the verification credential or token required by your integration.
  4. Copy the required token if it is displayed or provided during configuration.
  5. Store it securely and make sure it matches the value expected by your restaurant dashboard.


Note: Xendit may use a webhook callback token or a signature-verification mechanism depending on the integration. Follow the instructions for the specific webhook configuration and the fields shown in your restaurant dashboard. Do not substitute your Secret API Key for the webhook verification token.


5. Enter the Credentials in Your Restaurant Dashboard


  1. Log in to your restaurant dashboard.
  2. Go to Settings → Payments → Payment options.
  3. Open Manage gateways and select Xendit.
  4. Enter each credential into its corresponding field:
    • Public API Key: Your Xendit public key, if requested.
    • Secret API Key: Your Xendit secret key, if requested.
    • Webhook Verification Token: The token required by your webhook integration.
  6. Verify that the credentials match the selected environment.
  7. Click Save.


Only enter the credentials requested by the Xendit gateway configuration.


6. Important Security Notes


  • Use Test credentials for testing and Live credentials for real payments.
  • Grant only the permissions required by your integration.
  • Never share your Secret API Key or webhook verification token publicly.
  • If you replace a key or token, update the corresponding value in your restaurant dashboard.
  • Test payment processing and webhook notifications before accepting live payments.


Official documentation:


Updated on: 21/10/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!