Authentication
Required headers, timestamp window, and IP allow-listing.
Every API call carries four headers. Missing or malformed headers fail with 401 or 403 before reaching the handler.
| Header | Description | Example |
|---|---|---|
X-API-Key | Your API key | key_abc123def456 |
X-Timestamp | Request timestamp in milliseconds since epoch | 1640995200000 |
X-Nonce | Unique request identifier, minimum 8 characters | a1b2c3d4e5f6g7h8 |
X-Signature | HMAC-SHA256 signature, base64-encoded | dGVzdC1zaWduYXR1cmU= |
Security requirements
You authenticate the server, not a user. There is no per-user OAuth. Card-holder identity is captured separately through KYC.
See Request Signing for how X-Signature is computed.