Credentials
Everything you copy from the dashboard before the first API call.
Portal
Staff sign in at the dashboard with email and password. That cookie cannot call /v1. Use it to read Payments, Customers, and Settings.
- Open Settings → Developer — copy Merchant ID, Base URL, and create an API key (shown once).
- Open Settings → Notifications — save your callback URL and store the signing secret on the server.
- Open Settings → Merchant for workspace name and logo, then Settings → Checkout for timeout, redirects, tolerances, and allowed assets.
Values
| Field | Where | Used for |
|---|---|---|
Merchant ID | Settings → Developer | Support and reconciliation. Not sent on API calls. |
API key | Settings → Developer | Authorization: Bearer pk_… |
Base URL | Settings → Developer | All /v1 routes. Local default http://127.0.0.1:43120 |
Webhook URL + secret | Settings → Notifications | Order notifications |
Display name / logo | Settings → Merchant | Shown in the checkout popup |
Timeout, assets, URLs | Settings → Checkout | Popup defaults and matching |
Rotate
Resetting keys revokes every active prefix immediately. Update the CRM env var before the next create. Rotating the webhook secret invalidates the previous HMAC — deploy the new secret first, then rotate, or deliveries fail until you catch up.