Skip to main content
Every request to the Merchant API must include your secret key in the X-Api-Key header. There are no other auth schemes — no OAuth, no bearer tokens.

​
Getting your key

Your API key is issued per business from the dashboard. The same place also holds your webhook secret, which is separate and used only to verify webhook signatures — see WebHooks.
The API key is a secret. Send it only from your server — never from a browser, mobile app, or committed code. If it leaks, revoke it in the dashboard; the old key stops working immediately.

​
How requests are checked

Each request is validated in order:
1

Key present and known

A missing or unrecognized key is rejected with 401 API_KEY_INVALID. An unknown key returns the same error as a missing one — we don’t reveal whether a key exists.
2

Key active

A revoked key returns 403 API_KEY_REVOKED.
3

Business active

If your business isn’t in the active state, the request is rejected with 403 BUSINESS_NOT_ACTIVE, and details.status carries the current state.
4

Account not blocked

If the account is blocked, the request is rejected with 403 MERCHANT_BLOCKED.

​
Errors

​
Account & key states

​
A key can be revoked from the dashboard, or automatically when a business is banned. All requests with it return 403 API_KEY_REVOKED. Issue a new key to restore access.
​
Only an active business can call the API. Other states — such as pending_verification, ready_to_start, rejected, or banned — return 403 BUSINESS_NOT_ACTIVE with the exact state in details.status.
​
If the underlying account is blocked, every request returns 403 MERCHANT_BLOCKED regardless of key or business state.
A 403 here is about your account, not the specific request — retrying won’t help until the key, business, or account state is resolved. Resolve it in the dashboard or with support.

​
Rate limiting

Requests are rate limited per API key. Over the limit returns 429 RATE_LIMITED; back off and retry. See Errors.