Authentication

Every request carries the merchant's token in the Api-Token header:

Api-Token: YOUR_API_TOKEN

Authentication is the token alone — there is nothing to sign, hash or compute per request.

The one public endpoint

GET /api/health needs no token. Every other endpoint requires the header.

What the token allows

A token has full access to the merchant account it belongs to: it can read everything and it can move money, payouts included.

Treat it as a production secret:

• keep it server-side — not in a browser, a mobile app or anything shipped to a device;
• keep it out of repositories, logs, error reports and support tickets;
• give it to as few of your own systems as need it;
• ask for a replacement if you think it has been exposed.

Getting a token

API tokens are issued on request — you receive yours rather than generating it. Ask for a replacement in advance of any planned rotation.

AUTHENTICATED REQUEST

curl 'https://api.example.com/api/members' \
  -H 'Api-Token: YOUR_API_TOKEN'

PUBLIC REQUEST — NO TOKEN

curl 'https://api.example.com/api/health'

WRITE REQUEST

curl -X POST 'https://api.example.com/api/transfers' \
  -H 'Api-Token: YOUR_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "asset": "usdt",
    "amount": "25",
    "sender_id": 90210,
    "recipient_id": 90211
  }'

When a token is rejected

Code	HTTP	Meaning
—	401	The header is missing or empty
2008	401	The token does not match any account

Neither resolves on a retry. Surface the failure and check the token rather than backing off and trying again. See Errors for the rest of the catalogue.