Skip to main content
An API key carries one or more scopes — the same permissions shown when you create a key in the dashboard’s API Keys screen. A Bearer token can only access endpoints whose required scope it holds; otherwise the request returns 403.
All paths above are under /merchant/api. Every endpoint except POST /merchant/api/auth and GET /merchant/api/status requires a Bearer token with the matching scope.

​
Choosing scopes

Grant the least privilege needed:
  • A checkout integration that only collects payments needs pay (plus balance to reconcile, and webhooks to receive settlement events).
  • A payroll integration needs payout or bulk_pay and beneficiaries.
  • A read-only reporting tool needs just balance.
You choose scopes twice: when creating the key (the maximum it can ever use) and optionally when requesting a token via /auth (a subset for that token).