---
url: /payglocal-whmcs/guides/payglocal-keys.md
description: >-
  Generate your RSA key and download PayGlocal's common certificate from the GCC
  dashboard, store them securely outside the web root, and enter the paths and
  KIDs in WHMCS.
---

# PayGlocal key setup

PayGlocal secures every payment request with a pair of RSA keys: **your** merchant key (used to
sign requests) and **PayGlocal's** key (used to encrypt requests and verify results). Before you
can take a payment, you need both keys on your server and their details entered in the gateway.
This guide walks you through generating them in the PayGlocal **GCC dashboard**, storing them
safely, and wiring them into WHMCS.

::: info What's a KID?
Each key has a **Key ID (KID)** — a short identifier PayGlocal uses to know which key you're
using. You'll copy two KIDs into WHMCS: one for your merchant key, one for PayGlocal's key.
:::

## Before you start

You need access to the **PayGlocal GCC dashboard** for your merchant account, and a secure
directory on your server that sits **outside the web root** (not under `public_html`). Have your
Merchant ID (MID) handy too.

## Step 1 — Generate your merchant RSA key

In the GCC dashboard, open **Key Management** and choose **Generate an RSA key**.

* Download the resulting private key `.pem` file.
* Note its **KID** — this is your **merchant private key** KID.

Keep this file private: it's what proves payment requests are genuinely from you.

![Generating an RSA key in the GCC dashboard](/payglocal-whmcs/img/payglocal-payglocal-keys-generate.png)
*PayGlocal GCC dashboard → Key Management → Generate an RSA key*

## Step 2 — Download PayGlocal's common certificate

Still in **Key Management**, download the **PayGlocal Common Certificate** (`.pem`).

* Save the `.pem` file.
* Note its **KID** — this is the **PayGlocal public key** KID.

This is the key the gateway uses to encrypt requests to PayGlocal and to verify the signatures on
results coming back.

![Downloading the PayGlocal common certificate](/payglocal-whmcs/img/payglocal-payglocal-keys-common-certificate.png)
*PayGlocal GCC dashboard → Key Management → Common Certificate*

## Step 3 — Upload both keys outside the web root

Copy both `.pem` files to a secure directory on your WHMCS server that the browser **cannot**
reach — for example `/home/user/keys/`, not anywhere under `public_html`.

Then lock down their permissions so only the web-server user can read them:

```
chmod 640 /home/user/keys/merchant_private.pem
chmod 640 /home/user/keys/payglocal_public.pem
```

::: warning Never put keys in the web root
A private key that's reachable over the web is a serious risk. Always store both `.pem` files
outside `public_html` and use `chmod 640`. See [Security](/payglocal-whmcs/features/security).
:::

## Step 4 — Enter the paths and KIDs in WHMCS

Open **Setup → Payment Gateways → PayGlocal** and fill in the key fields with the absolute paths
and the two KIDs you noted:

| Field | What to enter |
| --- | --- |
| **Merchant Private Key File Path** | Absolute path to your merchant private key `.pem` (e.g. `/home/user/keys/merchant_private.pem`) |
| **Merchant Private Key ID (KID)** | The KID of your merchant private key (from Step 1) |
| **PayGlocal Public Key File Path** | Absolute path to PayGlocal's public key `.pem` (from Step 2) |
| **PayGlocal Public Key ID (KID)** | The KID of PayGlocal's common certificate (from Step 2) |

Click **Save Changes**. Also confirm your **Merchant ID (MID)** and **License Key** are filled in.

![The PayGlocal key path and KID fields](/payglocal-whmcs/img/payglocal-payglocal-keys-fields.png)
*Setup → Payment Gateways → PayGlocal*

::: tip Match keys to the environment
Sandbox (UAT) and production use **different** keys. Generate and use UAT keys while testing, then
swap in production keys before going live — see [Going live](/payglocal-whmcs/guides/going-live).
:::

## Related pages

* [Going live](/payglocal-whmcs/guides/going-live) — test in sandbox, then switch to production
* [Configuration](/payglocal-whmcs/configuration) — all gateway fields explained
* [Security](/payglocal-whmcs/features/security) — why key storage matters
* [How payments work](/payglocal-whmcs/features/payment-flow) — how these keys are used
* [Troubleshooting](/payglocal-whmcs/troubleshooting) — key and verification errors