Quickstart
Prerequisites
Get your API credentials
Obtain the following information from the API configuration page:
- API Key — format
key_xxxxxxxxxxxx - API Secret — format
secret_xxxxxxxxxxxx
Store the secret like a database password. It is never transmitted as part of a request — it only signs payloads.
Whitelist your egress IPs
Provide the static egress IPs that will make API calls. Requests from any non-whitelisted IP are rejected at the edge with 403 Forbidden.
Set up a webhook endpoint
Stand up an HTTPS endpoint that can receive POST requests and return 2xx within 10 seconds. You'll register the URL with us and verify signatures using the same algorithm as outbound requests.
Your first request
Every request needs four headers (X-API-Key, X-Timestamp, X-Nonce, X-Signature). The simplest endpoint to verify your signing is GET /card-bins, which lists the BIN ranges configured for your project.
curl -X GET https://api.buvei.com/open-api/v1/card-bins \
-H "X-API-Key: key_your_api_key" \
-H "X-Timestamp: 1640995200000" \
-H "X-Nonce: a1b2c3d4e5f6g7h8" \
-H "X-Signature: your_calculated_signature"A successful call returns the BINs available to your project:
{
"code": 0,
"message": "SUCCESS",
"data": [
{
"cardBinId": "v_123456",
"bin": "555543",
"brand": "VISA",
"issuingCountry": "US",
"currency": "USD",
"mobile": false,
"email": false,
"supportPin": false,
"requireKycCardholder": true
}
]
}If you get 403 Forbidden, double-check IP whitelisting first, then signature. The error response body distinguishes the two.