BxBytix

Authentication

CRM API calls use a Bearer key. The portal uses a cookie. Webhooks use HMAC.

API key

http
POST http://127.0.0.1:43120/v1/orders
Authorization: Bearer pk_...
Content-Type: application/json
  • Every CRM endpoint requires this header: POST /v1/orders, POST /v1/orders/info, GET /v1/coins.
  • Send Bearer plus the full key. A key without the scheme is also accepted, but prefer Bearer.
  • Keys are hashed at rest and shown once on create or reset. The portal keeps a prefix for identification.
  • Revoke a prefix from Settings → Developer, or reset all active keys at once.

Portal

Staff sign in with email and password. That cookie cannot call /v1. Use it to read payments, withdrawals, customers, and Settings. Do not mix session cookies with API keys on the same request.

Webhooks

Incoming notifications are signed with HMAC-SHA256 of the JSON body we POST. They are not authenticated with your pk_ key. See Webhooks.

PreviousCredentialsNext Checkout popup