{"section":"announcements","requestedLocale":"en","requestedSlug":"2022-10-13-credentials-in-gateway-affiliations-must-be-provided-by-the-payment-provider","locale":"en","slug":"2022-10-13-credentials-in-gateway-affiliations-must-be-provided-by-the-payment-provider","path":"docs/en/announcements/2022/october/2022-10-13-credentials-in-gateway-affiliations-must-be-provided-by-the-payment-provider.md","branch":"main","content":"When configuring [gateway affiliations](/en/docs/tutorials/registering-gateway-affiliations) in the Admin to make payments available in your store, you must enter the following credentials to identify your store for the payment provider: **Application Key** and **Application Token**. These credentials have the same function as user and password and must be provided by the payment provider.\n\n## What has changed?\n\nThese credentials should not be mistaken for the [Application Key and Application Token credentials used in VTEX APIs for integrations](/en/docs/tutorials/api-keys). In this case, credentials are generated in the Admin and used to identify external systems that access VTEX stores' services. You can identify an **Application Key** generated in the Admin by having `vtexappkey-` at its beginning.\n\nIf your store has any gateway affiliations configured with a pair of **Application Key** and **Application Token** generated in the Admin, you must replace them by April 30, 2023.\n\n## Why did we make this change?\n\nUsing the **Application Key** and **Application Token** generated in the Admin in gateway affiliations can pose a security risk, as keys are being shared to access services from a VTEX store. The [role](/en/docs/tutorials/roles) assigned to a credential defines which [store resources](/en/docs/tutorials/license-manager-resources) a given user can access. Depending on the role, anyone with access to the credentials can access the allowed resources improperly. You can check the instructions in the [Application Keys](/en/docs/tutorials/api-keys) article to disable an **Application Key** if needed.\n\n## What needs to be done?\n\nThe payment provider must provide the credentials for the affiliation being configured. The keys must be replaced by April 30, 2023. You can find the instructions for configuring them in the [Registering gateway affiliations](/en/docs/tutorials/registering-gateway-affiliations) article."}