Authentication

Authenticate server-to-server API requests with your merchant API key, sent in the x-api-key header. We issue this key for your account, and it identifies your business on every call to the payments API.

curl -X POST https://api.xenonpay.net/api/payments/session \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"amount": 500, "order_id": "order-123"}'

Your API key can create live payments. Keep it on your server, never commit it to source control, and never expose it in browser or mobile code.

Which requests need the key

The x-api-key header is required to create a payment session. Checking a session's status is public — it uses the session token in the URL and does not need your API key.

Authentication errors

Situation	Status	Response
No `x-api-key` header	401	`{"error":"API key required"}`
Key does not match an active merchant	401	`{"error":"Invalid API key"}`
Your account is not active	401	`{"error":"Invalid API key"}`
API access has been revoked	403	`{"error":"API access has been revoked. Contact support."}`

Was this helpful?