Strike API Keys

Your Strike API key lets Lightning Enable create invoices and read payment status on your behalf. Lightning Enable stores the key encrypted and never returns it back out of the API.

Strike is the default payment provider. If you have not created your Strike account yet, start with Strike Account Setup.

Required Scopes

Lightning Enable needs three scopes. Grant all three.

Validation Does Not Check Scopes

POST /api/merchant/validate-strike confirms your key authenticates against Strike by reading your account profile. It does not exercise any of the scopes below, so a key with none of them still validates successfully. A missing scope surfaces later, as a failure on your first real invoice or a webhook that never arrives. Grant all three at creation rather than relying on validation to catch a gap.

Scope	Purpose	Required?
partner.receive-request.read	Check invoice and payment status	Yes
partner.receive-request.create	Create Lightning invoices	Yes
partner.webhooks.manage	Auto-register the webhook subscription	Yes

Scope Labels

Strike's dashboard sometimes labels this scope "write" rather than "create". The identifier Strike issues is partner.receive-request.create — grant whichever label allows creating receive requests.

Stuck on scopes? Ask us

This is the step people most often get wrong, and validation will not catch it (see the warning above). Email support@lightningenable.com with what you are seeing in the Strike dashboard and we will tell you exactly which boxes to tick — or set it up with you on a call if that is easier.

Generate a Key

1. Sign in to dashboard.strike.me
2. Go to API Keys
3. Click Create API Key
4. Name the key so you can identify it later, for example Lightning Enable Production
5. Enable all three scopes from the table above
6. Click Create and copy the key

Strike Shows the Key Once

Strike displays the full API key only at creation. Copy it immediately and store it in a password manager or secret store. If you lose it, create a new key — you cannot recover the original.

Configure in Lightning Enable

There are two ways to save your key, and no others. There is no environment variable or configuration file to set.

Using the Dashboard

1. Sign in to the Lightning Enable dashboard
2. Go to Settings
3. Under Payment Provider, select Strike
4. Paste your key and click Save Key
5. Click Validate to confirm the key works

Using the Merchant API

Save the key:

curl -X PUT https://api.lightningenable.com/api/merchant/strike-key \
  -H "X-API-Key: your-merchant-api-key" \
  -H "Content-Type: application/json" \
  -d '{ "strikeApiKey": "your-strike-api-key" }'

Validate it:

curl -X POST https://api.lightningenable.com/api/merchant/validate-strike \
  -H "X-API-Key: your-merchant-api-key"

Saving a Strike key through either method above already sets Strike as your provider if you had not chosen one. To set it explicitly at any time:

curl -X PUT https://api.lightningenable.com/api/merchant/payment-provider \
  -H "X-API-Key: your-merchant-api-key" \
  -H "Content-Type: application/json" \
  -d '{ "provider": "strike" }'

The provider field accepts strike or opennode.

Provider Resolution

Lightning Enable resolves your provider in this order:

1. An explicit choice on your account wins.
2. With no explicit choice and exactly one provider key saved, that key's provider is used.
3. Otherwise — including when you have both a Strike and an OpenNode key saved but no explicit choice — Lightning Enable falls back to the platform default, which is Strike.

Case 3 is the one that surprises merchants migrating from OpenNode: keeping both keys does not keep you on OpenNode. Set the provider explicitly if you want a specific lane.

Key Security

• Configure the key only through the dashboard or PUT /api/merchant/strike-key. Never commit it to source control or paste it into client-side code.
• Lightning Enable encrypts your key at rest with AES-256-GCM and never returns it from the API once saved.
• Keep any copy of the key in a password manager or secret store.
• If you suspect the key leaked, revoke it in the Strike dashboard immediately, then save a new one.
• Enable two-factor authentication on your Strike account.

Key Rotation

Rotate your key every 90 days, after someone with access leaves, or any time you suspect exposure.

1. Create a new key in the Strike dashboard with all three scopes
2. Save it in Lightning Enable through the dashboard or PUT /api/merchant/strike-key
3. Validate it with POST /api/merchant/validate-strike
4. Confirm a small real payment succeeds — see Testing
5. Revoke the old key in the Strike dashboard

The update takes effect immediately. Subsequent payments use the new key, so there is no downtime window to manage.

Checking Key Status

To confirm a key is saved without revealing it:

curl -X GET https://api.lightningenable.com/api/merchant/me \
  -H "X-API-Key: your-merchant-api-key"

The response reports whether a key is present, not the key itself.

Troubleshooting

Validation Reports isValid: false

POST /api/merchant/validate-strike returns HTTP 200 whether or not the key works — read the isValid field in the body rather than the status code. If it reports false:

1. Check the key was copied without extra spaces
2. Check the key has not been revoked in the Strike dashboard
3. Confirm a key is actually saved — the same response reports when none is configured
4. Create a new key and save it again

Note that validation passing tells you nothing about scopes. See Required Scopes.

Invoices Are Not Created

1. Confirm the key has partner.receive-request.create
2. Check that your Lightning Enable subscription is active
3. Look for error detail in the Lightning Enable dashboard

Webhooks Do Not Arrive

Lightning Enable registers the Strike webhook subscription automatically on your first payment. If status updates never arrive:

1. Confirm the key has partner.webhooks.manage
2. Check your Strike dashboard for a webhook subscription
3. Create another payment to trigger re-registration

For more detail, see Webhooks.

Next Steps

• Webhooks — Understand both webhook hops and verify signatures
• Testing — Confirm your integration end to end
• First Payment — Take your first payment