> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendpadi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> HMAC and optional OAuth2 for SendPadi merchant API.

# Authentication

Create API keys in the [developer dashboard](https://developer.sendpadi.com) (opens in a new tab from most browsers when using the dashboard CTA).

To fill playground headers quickly, use [Sign requests](https://docs.sendpadi.com/guides/sign-requests.md).

## Required headers

| Header | Required | Description |
| - | - | - |
| `X-Api-Key` | Yes | Public key id (`sp_test_…` / `sp_live_…`) |
| `X-Timestamp` | Yes | Unix time in seconds |
| `X-Signature` | Yes | HMAC-SHA256 hex of the canonical string |
| `Idempotency-Key` | Writes only | UUID on money-moving writes |

## Canonical string

```
{timestamp}.{METHOD}.{path}.{rawBody}
```

* `METHOD` uppercase
* `path` without host or query
* `rawBody` exact JSON bytes (empty string for GET)

```javascript theme={null}
import crypto from 'crypto';

const timestamp = Math.floor(Date.now() / 1000).toString();
const method = 'GET';
const path = '/api/v1/merchant/wallets';
const rawBody = '';
const payload = `${timestamp}.${method}.${path}.${rawBody}`;
const signature = crypto.createHmac('sha256', secret).update(payload, 'utf8').digest('hex');
```

## OAuth2 (optional)

When enabled: `POST /api/v1/merchant/oauth/token` with client credentials, then `Authorization: Bearer` **only if HMAC headers are absent**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.