Authentication
Merchant API requests use an API key. Send it from your server in the x-api-key header.
curl "https://api.example.com/api/merchant/payment-intents" -H "x-api-key: YOUR_MERCHANT_API_KEY"Keep API keys server-side
You can also use Authorization: Bearer YOUR_MERCHANT_API_KEY. Do not place the key in client-side code, source control, logs, or screenshots.
Idempotency for money-moving requests
Creating a payment intent or withdrawal, or confirming a payment requires an Idempotency-Key header. Generate a unique 16–255 character key for one logical operation, and retain it until you know the operation's result.
Retry safely
If a network failure occurs, retry the exact same request with the same key. ImportaPay returns the completed result rather than running the operation twice. Do not reuse a key for changed request data: that returns 409. If an identical request is already running, wait for the Retry-After value and retry; it returns 423 while the original request is in progress.
curl -X POST "https://api.example.com/api/merchant/payment-intents" \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_MERCHANT_API_KEY" \
-H "Idempotency-Key: 5ca44288-d7d3-4192-8796-a1a34c2b4e70" \
-d '{"merchantReference":"INV-3021","amount":85000}'Dashboard session
Setup endpoints use your Merchant Dashboard session rather than an API key. They are intended for dashboard use, not a third-party integration.