Get your PayGlocal keys

PayGlocal Recurring secures every request with a pair of RSA keys: your merchant private key and PayGlocal's public key. Each key has a KID (Key ID) that tells PayGlocal which key you're using. This guide walks you through getting both from the PayGlocal GCC dashboard, placing them safely on your server, and entering their paths and KIDs into the gateway.

What a KID is

A KID is the Key ID that identifies one specific key in PayGlocal's dashboard. Every key you generate or download has one, and the gateway needs it alongside the key file so PayGlocal can match request to key.

1. Generate your merchant RSA key

Log in to the PayGlocal GCC dashboard and open Key Management. Generate an RSA key, then download the .pem file and note its KID. This is your merchant private key — the key the gateway signs and decrypts with.

Keep this file private

This is a private key. Anyone who has it can act as you. Download it somewhere safe and never place it where it could be served over the web.

2. Download the PayGlocal Common Certificate

Still in Key Management, download the PayGlocal Common Certificate — the .pem file — and note its KID. This is PayGlocal's public key, which the gateway uses to verify PayGlocal's signatures and encrypt payloads to them.

Match the environment

Keys are environment-specific. Use your UAT keys while testing in sandbox and your production keys when you go live — mixing them causes verification failures. See Test in sandbox, then go live.

3. Upload both keys outside the web root

Copy both .pem files to a secure directory on your server that is outside the web root, so they can never be downloaded by a visitor. Then set permissions so the web-server user can read them but nothing else can:

chmod 640 /home/user/keys/merchant_private.pem
chmod 640 /home/user/keys/payglocal_public.pem

Note the absolute path of each file — you'll need it in the next step.

4. Enter the paths and KIDs in the gateway

Go to Setup → Payment Gateways → PayGlocal Recurring and fill in the four key fields from what you gathered above:

Gateway field	What you enter
Merchant Private Key File Path	Absolute path to your merchant private key .pem
Merchant Private Key ID (KID)	The KID of your merchant private key
PayGlocal Public Key File Path	Absolute path to the PayGlocal Common Certificate .pem
PayGlocal Public Key ID (KID)	The KID of PayGlocal's public key

Click Save Changes. With both keys in place, the gateway can sign, encrypt, and verify everything it exchanges with PayGlocal.

Don't regenerate keys casually

Existing mandates were authorised against your current keys. If you replace or regenerate them without care, existing recurring charges can break. Back up your .pem files and only change keys when you mean to.

Related pages

• Configuration — the full setup walkthrough
• Settings reference — every gateway field explained
• Test in sandbox, then go live — try your keys safely first
• Security — how these keys protect payments