Skip to main content
The Merchant API uses a two-step credential model:
  1. API key + secret — long-lived credentials tied to your merchant account. Created in the dashboard’s API Keys screen. Never expose the secret in client-side code.
  2. Bearer token — a short-lived JWT you obtain from the key + secret. It embeds a set of scopes and is sent on every API call.

Get a token

string
required
Your API key, e.g. mk_....
string
required
Your API secret, e.g. ms_....

Body parameters

string[]
Subset of your key’s scopes to embed in the token. Defaults to ["pay", "deposit", "balance"] if omitted.
integer
default:"24"
Token lifetime in hours, between 1 and 720 (30 days).
The /auth endpoint is rate limited to 20 requests per 15 minutes. Cache and reuse the token until it expires rather than authenticating on every call.

Use the token

Send it as a Bearer token on every other endpoint:
If the token is missing or invalid you get 401. If it is valid but lacks the scope an endpoint requires, you get 403 with the required scope named in the message.

IP whitelisting

If you add IP addresses to your account’s whitelist (dashboard → API Keys → IP Whitelist), requests from any other IP are rejected with 403, even with a valid token. Leave the whitelist empty to allow all IPs.

Security best practices

The API secret and Bearer tokens must never appear in browser or mobile app code. Make API calls from your backend.
Only grant a key the scopes it needs, and request an even narrower set in the /auth call when appropriate.
You can regenerate your API credentials from the dashboard at any time. Doing so immediately invalidates the old key.