Get started

Authentication

Every request carries your API key in a header. The same key identifies your account, so it is the one secret to protect.

Send your API key as Authorization: Bearer <api_key>.

The older key parameter still works, but a key in a URL ends up in server logs, proxy logs and browser history. Responses to requests that use it carry Deprecation: true and a Link header with rel="deprecation".

A missing key is 400 parameter_missing. A malformed or unknown key is 401 key_or_user_not_found. A valid key on a suspended account is 403 account_suspended: the key itself is fine, so do not rotate it; contact support.

A few endpoints also work without a key. /api/transaction/info and /api/user/info return a public view. /api/transaction/setpaymentmethod and /api/transaction/cancel accept the transaction's own private_key, which is what a checkout holds.

Sending the key

Read it from the environment rather than from your source, and send it on every call. This lists your balances:

RequestcURLPythonNode.jsPHP

curl https://anonpay.org/api/user/balances \
  -H "Authorization: Bearer $APA_KEY" \
  -d user_id=4b8e2d0f6a1c3e5b7d9f0a2c4e6b8d0f \
  -d currency=btc,xmr

import os
import requests

KEY = os.environ["APA_KEY"]

response = requests.post(
    "https://anonpay.org/api/user/balances",
    headers={"Authorization": f"Bearer {KEY}"},
    data={
        "user_id": "4b8e2d0f6a1c3e5b7d9f0a2c4e6b8d0f",
        "currency": "btc,xmr",
    },
    timeout=30,
)
print(response.json())

const url = "https://anonpay.org/api/user/balances";

const response = await fetch(url, {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.APA_KEY}` },
  body: new URLSearchParams({
    user_id: "4b8e2d0f6a1c3e5b7d9f0a2c4e6b8d0f",
    currency: "btc,xmr",
  }),
});
console.log(await response.json());

$url = 'https://anonpay.org/api/user/balances';
$key = getenv("APA_KEY");

$ch = curl_init($url);
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => ["Authorization: Bearer $key"],
    CURLOPT_POSTFIELDS => http_build_query([
        "user_id" => '4b8e2d0f6a1c3e5b7d9f0a2c4e6b8d0f',
        "currency" => 'btc,xmr',
    ]),
    CURLOPT_RETURNTRANSFER => true,
]);
$response = json_decode(curl_exec($ch), true);

Rotating the key

Rotate it in the dashboard under Developer, or call Update seller settings with update_key=1 and your current_password. The response carries the new key in data.new_key.

Keep the key on your server

Anyone holding it can create transactions, change your settings and withdraw your balance. Never put it in a web page, an app or a repository, and rotate it if it ever leaks.