---
url: /payglocal-recurring-whmcs/guides/payglocal-keys.md
description: >-
  Step-by-step — generate your merchant RSA key and download PayGlocal's Common
  Certificate in the GCC dashboard, place both outside the web root, and enter
  the paths and KIDs into the gateway.
---

# Get your PayGlocal keys

PayGlocal Recurring secures every request with a pair of RSA keys: **your merchant private key**
and **PayGlocal's public key**. Each key has a **KID** (Key ID) that tells PayGlocal which key
you're using. This guide walks you through getting both from the PayGlocal **GCC dashboard**,
placing them safely on your server, and entering their paths and KIDs into the gateway.

::: info What a KID is
A **KID** is the Key ID that identifies one specific key in PayGlocal's dashboard. Every key you
generate or download has one, and the gateway needs it alongside the key file so PayGlocal can
match request to key.
:::

## 1. Generate your merchant RSA key

Log in to the PayGlocal **GCC dashboard** and open **Key Management**. **Generate an RSA key**,
then **download the `.pem` file** and **note its KID**. This is your **merchant private key** —
the key the gateway signs and decrypts with.

::: warning Keep this file private
This is a private key. Anyone who has it can act as you. Download it somewhere safe and never
place it where it could be served over the web.
:::

## 2. Download the PayGlocal Common Certificate

Still in **Key Management**, **download the PayGlocal Common Certificate** — the `.pem` file — and
**note its KID**. This is **PayGlocal's public key**, which the gateway uses to verify PayGlocal's
signatures and encrypt payloads to them.

::: tip Match the environment
Keys are environment-specific. Use your **UAT** keys while testing in sandbox and your
**production** keys when you go live — mixing them causes verification failures. See
[Test in sandbox, then go live](/payglocal-recurring-whmcs/guides/going-live).
:::

## 3. Upload both keys outside the web root

Copy both `.pem` files to a secure directory on your server that is **outside the web root**, so
they can never be downloaded by a visitor. Then set permissions so the web-server user can read
them but nothing else can:

```
chmod 640 /home/user/keys/merchant_private.pem
chmod 640 /home/user/keys/payglocal_public.pem
```

Note the **absolute path** of each file — you'll need it in the next step.

## 4. Enter the paths and KIDs in the gateway

Go to **Setup → Payment Gateways → PayGlocal Recurring** and fill in the four key fields from what
you gathered above:

| Gateway field | What you enter |
| --- | --- |
| **Merchant Private Key File Path** | Absolute path to your merchant private key `.pem` |
| **Merchant Private Key ID (KID)** | The KID of your merchant private key |
| **PayGlocal Public Key File Path** | Absolute path to the PayGlocal Common Certificate `.pem` |
| **PayGlocal Public Key ID (KID)** | The KID of PayGlocal's public key |

Click **Save Changes**. With both keys in place, the gateway can sign, encrypt, and verify
everything it exchanges with PayGlocal.

::: warning Don't regenerate keys casually
Existing mandates were authorised against your current keys. If you replace or regenerate them
without care, existing recurring charges can break. Back up your `.pem` files and only change keys
when you mean to.
:::

## Related pages

* [Configuration](/payglocal-recurring-whmcs/configuration) — the full setup walkthrough
* [Settings reference](/payglocal-recurring-whmcs/settings) — every gateway field explained
* [Test in sandbox, then go live](/payglocal-recurring-whmcs/guides/going-live) — try your keys safely first
* [Security](/payglocal-recurring-whmcs/features/security) — how these keys protect payments