What you need
| Value | Looks like | Where it comes from |
|---|---|---|
| Gateway URL | https://secure.yourgateway.com/api/transact.php | Your processor’s documentation |
| Security key | A long alphanumeric string | Generated in the gateway portal |
Creating an API user
Do not reuse a person’s login. Create a dedicated user for the store so access can be revoked without locking anyone out.
- In the gateway portal open Settings, User Accounts and add a user.
- Grant only what the store needs: sale, authorize, capture, void, refund, and Customer Vault if you want saved cards.
- Under Settings, Security Keys, generate a key for that user.
- Copy the key immediately. It is displayed once and cannot be retrieved later.
Finding the endpoint
The endpoint is your processor’s own domain, not ours and not NMI’s. It almost always ends in /api/transact.php. If your processor documents a different path, use theirs.
If you cannot find it, ask your account manager for the API credentials for a third party shopping cart. That phrasing gets the right answer faster than asking about NMI by name.
Sandbox versus production
These are separate accounts with separate keys. Never point a staging site at production credentials, because eventually someone places a test order and charges a real card.
Rotating a key
- Generate a new key for the same API user.
- Paste it into the plugin and press Test connection.
- Place one transaction to confirm.
- Delete the old key in the gateway.
Rotate whenever someone with access leaves, and after any incident on the host.
Multiple merchant accounts
On the Enterprise plan each account is added separately with its own endpoint, key and label, then selected by routing rules. See multiple merchant IDs.