Skip to main content
Authentication is a two-step process: exchange your account credentials for an access token (API key) once, then send that token with every subsequent request.

Step 1 — Generate your access token

Send a POST request to /api/user with your account credentials encoded as HTTP Basic Auth (base64(username:password)).

Response

Your AccessToken is your API key. Store it securely (e.g. an environment variable) and never expose it in client-side code.

Step 2 — Authenticate your requests

Include the token in the Authorization header using the Token scheme on every API call:
string
required
Token <your_access_token> — your API key from Step 1.
Requests without a valid token return 401 Unauthorized. Keep your key secret — anyone with it can spend your wallet balance.

Live vs. sandbox keys

Your account has two keys (both on your dashboard):
  • Live key — real transactions; your wallet is charged.
  • Sandbox key (sk_test_…) — test mode; calls are simulated and never charge your wallet.
They authenticate identically — just swap the key. See Sandbox & Test Mode.