Generate the encryption key

Before REDA Pay can do anything, it needs an encryption key. REDA Pay uses this key to encrypt every secret it stores in your org: the Payload API key, the identifiers Payload assigns to your profile, processing accounts, customers and payment methods, and the identifiers hidden inside payment links. Generating the key is a one-time, one-click step on the REDA Pay Admin tab. Until it is done, every REDA Pay screen stops with the message "REDA Pay setting(s) are invalid or not defined. Please contact your system administrator."

Why the key exists

Payload identifies your organisation, each merchant account, each customer and each saved card or bank account by an identifier. If those identifiers were readable by anyone who can open a record, a person with read access to your org could learn enough to call Payload on your behalf. REDA Pay therefore stores them encrypted, and the only thing that can decrypt them is the key held in your org. The same key protects your Payload API key, which is why the API key must be entered through the Update API Token button rather than typed into the field — the button encrypts it with this key.

The key is created once and never shown to anyone. REDA Pay keeps it in a protected setting that only the package itself can read.

Generate the key

1. Open the App Launcher (the nine-dot grid at the top left), search for REDA Pay, and open the app.
2. Click the REDA Pay Admin tab.
3. On the Encryption Key Setup card, read the note: "REDA Pay "Encryption Key" is must for REDA Pay App to function. If the "Encryption Key" is not generated, generate the key using following button."
4. Click Generate Key.
5. The button changes to Generated and is greyed out. That is the whole step — there is nothing to copy, save or enter anywhere.

The REDA Pay Admin tab with the Encryption Key Setup card; the button reads "Generated" because the key already exists in this org

After the key is generated, the button reads "Generated". Nothing else on this card changes afterwards.

If the button already reads Generated when you arrive, someone has done this step before and you can move on to Create a Pay Profile.

What you cannot do afterwards

• You cannot generate the key a second time. The button is disabled once a key exists. Everything REDA Pay has encrypted depends on that key, so replacing it would make every stored secret unreadable.
• You cannot view or export the key. It is not shown on any screen and not stored in any field you can read.
• Check each org separately. After creating or refreshing a sandbox, open the sandbox's REDA Pay Admin tab before you rely on REDA Pay there. If the button reads Generate Key, generate the key in that sandbox, then set up a Pay Profile there with a Payload API key for your test environment.

What the key protects

Anyone reading these records sees ciphertext. The key itself is held in a protected setting that only REDA Pay's own code can read; it is not shown in Setup, cannot be queried, and cannot be exported.

What to tell an auditor

• Secrets and identifiers are encrypted at rest with a key generated inside the org and never displayed.
• Card numbers, security codes and bank account numbers are never stored — see Security and card data.
• The key is created once per org by an administrator with the REDA Pay - Admin User permission set, and cannot be regenerated, replaced or exported.

Check that it worked

Open the Pay Profiles tab and create a Pay Profile as described in Create a Pay Profile. When you press Update API Token on it and save a key, the token is accepted and the API Token field shows an encrypted value. If instead you see "REDA Pay setting(s) are invalid or not defined. Please contact your system administrator.", the encryption key is missing — return to the Admin tab and generate it.

Mistakes to avoid

FAQ

Where to go next

• Create a Pay Profile and store your Payload API key — the next step.
• Setup roadmap — where this step sits in the whole setup.