Authentication

Create API keys in the developer dashboard (opens in a new tab from most browsers when using the dashboard CTA). To fill playground headers quickly, use Sign requests.

Required headers

Header	Required	Description
`X-Api-Key`	Yes	Public key id (`sp_test_…` / `sp_live_…`)
`X-Timestamp`	Yes	Unix time in seconds
`X-Signature`	Yes	HMAC-SHA256 hex of the canonical string
`Idempotency-Key`	Writes only	UUID on money-moving writes

Canonical string

{timestamp}.{METHOD}.{path}.{rawBody}

METHOD uppercase
path without host or query
rawBody exact JSON bytes (empty string for GET)

import crypto from 'crypto';

const timestamp = Math.floor(Date.now() / 1000).toString();
const method = 'GET';
const path = '/api/v1/merchant/wallets';
const rawBody = '';
const payload = `${timestamp}.${method}.${path}.${rawBody}`;
const signature = crypto.createHmac('sha256', secret).update(payload, 'utf8').digest('hex');

OAuth2 (optional)

When enabled: POST /api/v1/merchant/oauth/token with client credentials, then Authorization: Bearer only if HMAC headers are absent.