- API key + secret — long-lived credentials tied to your merchant account. Created in the dashboard’s API Keys screen. Never expose the secret in client-side code.
- Bearer token — a short-lived JWT you obtain from the key + secret. It embeds a set of scopes and is sent on every API call.
Get a token
string
required
Your API key, e.g.
mk_....string
required
Your API secret, e.g.
ms_....Body parameters
string[]
Subset of your key’s scopes to embed in the token. Defaults to
["pay", "deposit", "balance"] if omitted.integer
default:"24"
Token lifetime in hours, between
1 and 720 (30 days).The
/auth endpoint is rate limited to 20 requests per 15 minutes. Cache and reuse
the token until it expires rather than authenticating on every call.Use the token
Send it as a Bearer token on every other endpoint:401. If it is valid but lacks the scope an
endpoint requires, you get 403 with the required scope named in the message.
IP whitelisting
If you add IP addresses to your account’s whitelist (dashboard → API Keys → IP Whitelist), requests from any other IP are rejected with403, even with a valid
token. Leave the whitelist empty to allow all IPs.
Security best practices
Keep secrets server-side
Keep secrets server-side
The API secret and Bearer tokens must never appear in browser or mobile app code.
Make API calls from your backend.
Request least privilege
Request least privilege
Only grant a key the scopes it needs, and request an even narrower set in
the
/auth call when appropriate.Rotate credentials
Rotate credentials
You can regenerate your API credentials from the dashboard at any time. Doing so
immediately invalidates the old key.