Authentication

Every merchant route expects HTTP Basic authentication.

Authorization: Basic base64(api_user_id:api_key)
Content-Type: application/json

Create the user and key in the signed-in merchant portal under API keys. Keep both in environment variables. Do not put them in browser JavaScript, mobile apps, query strings, or logs.

Auth errors

• Missing header: HTTP 401, NO_AUTHORIZATION_HEADER.
• Header does not start with Basic : HTTP 403, INVALID_AUTHORIZATION_HEADER.
• Username or key missing: HTTP 403, MISSING_USER_OR_KEY.
• Unknown pair: HTTP 403, INVALID_USER_OR_KEY.
• Suspended organization: HTTP 403, ORGANIZATION_SUSPENDED.

There is no OAuth flow and no per-endpoint permission scope. The key acts for the organization stored on that credential.

Rotating a key is the regenerate action on the API keys page. The previous key stops matching. Webhook signing uses a different secret, described on the webhooks page. It is not this API key.