Create everything a platform needs to take cards for one merchant, in one call: a publishable key for the given allowedOrigins, a secret key pinned to the merchant, and, if you send webhookUrl, a webhook endpoint with its signing secret.

Only a Zenoz service-account key (X-API-Key) can call this, with the tenant in X-Tenant-Id. Any other caller gets a 404. Local and sandbox deployments only: production answers 403 COCOON_CREDENTIALS_LIVE_DISABLED, because live keys are created in the dashboard.

Calling it again with the same name for the same merchant revokes the keys the previous call created and gives the webhook endpoint a new secret. Every secret is shown once, in this response.