Skip to main content
Use Bearer authentication for merchant API requests. Copy the API URL from your dashboard and call it from your server, never from browser or mobile code.

​
Authorization header

​
Identify the account

Call GET /v1/me from your backend using the merchant key:
The response has no data envelope:
account_id is the stable merchant ID, not a dashboard-user or payment-provider ID. No extra scope is needed beyond a valid key with a supported scope. Suspended merchants are rejected. Responses must not be cached.

​
Replace an API key

  1. Store account_id when you connect a merchant.
  2. Look up the new key’s ID before saving it.
  3. If the ID matches, keep the account association and check the new scopes.
  4. If it differs, require an explicit account switch. Never move existing orders or webhooks automatically.

​
Customer checkout tokens

Checkout customer flows use opaque, short-lived capabilities returned by the checkout flow. Never manufacture, persist in a public page, or substitute a merchant API key for one. Next: review API keys and scopes, then create a checkout from your server.