Authentication

Every API request needs an API key. Create keys on the Manage API page of the merchant dashboard.

Send the key in the x-api-key header:

curl https://api.mmoneybb.com/merchant/v2/api/validate-api-key \
  -H "x-api-key: YOUR_API_KEY"

Key permissions

Each key carries its own permissions. Give a key only the permissions its integration needs. A request with a key that lacks the required permission fails.

Keep keys secret

• Do not put an API key in client-side code, except the key you use with the payment button embed.
• Store keys in your server’s secret store, not in source control.
• Rotate a key from the dashboard if you think it leaked.

Validate a key

GET /v2/api/validate-api-key confirms that a key is valid. It does not move money. Use it as the first call in a new integration.