Authentication

Every call except GET /health carries two things:

Where	What
Header x-api-key	Your merchant API key
Body merchantIdentifier	Your merchant id; it must belong to the key

POST /api/payment-process
x-api-key: <your key>
Content-Type: application/json

A wrong key, or a key that does not belong to the merchantIdentifier, answers 401. The key is compared in constant time.

After repeated failed attempts from one address the gateway answers 429 Too many failed attempts for a few minutes. Fix the key rather than retrying in a loop.

Get a key

In the sandbox you create your own on Get set up: once your access is approved, choose Create API key. Use Show and Copy there and put the key straight into your secret store. For live traffic your account manager issues it.

Keep the key safe

• Call the gateway from your server only. A key in a browser or app is a key anyone can copy.
• Store it in your secret manager or environment, never in source control.
• Use a separate key for testing and for live.
• If a key leaks, rotate it at once: in the sandbox use Rotate on Get set up, for live ask your account manager. The old key stops working immediately, so have the new one ready to deploy as you rotate.
• The hosted checkout never needs the key in a browser. See Hosted checkout.