Getting started

The base URL and the authorization rules that every request must follow.

Two API keys

Two separate keys are generated in the merchant dashboard, in the API keys section. They are not interchangeable.

The key itself is never sent — it signs the body: the sign header carries md5(base64(body) . key), where body is the exact JSON string you send in the request (a request without a body signs an empty string). Which key to use depends on the method you call: a signature made with a key that does not match the method type (a payout key on payment/*, for example) will not pass authorization.
The previous way — the key in plain text in the key header instead of sign — keeps working but is deprecated: build new integrations on sign.
Your Merchant UUID is in the merchant dashboard, in the "Merchant" section.

Content-Type: application/json 
merchant: 019e****-****-****-****-*******69cab
sign: <md5(base64(body) . main key or payout key)>

// body — the JSON string exactly as it is sent
sign = MD5( base64( body ) . api_key )

// a request without a body signs an empty string
sign = MD5( base64( '' ) . api_key )   // same as MD5( api_key )

// PHP
$sign = md5(base64_encode($jsonBody) . $apiKey);

Error format and response codes

The API returns error responses in several formats depending on the kind of problem. All error messages are returned in English.