Required headers
Send these headers on every request:Examples
Secret storage best practices
- Store your API Key and API Secret in a dedicated secret manager (for example, AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault).
- Read credentials into environment variables at runtime. Example
.envfile for local development:.env - Rotate credentials if they are ever logged, committed, or exposed.
- Secrets cannot be recovered after their first display is closed. Save both values securely when they are first generated.
Merchant ID is not a credential
Your Merchant ID appears alongside your API credentials but does not authenticate requests. It is used for merchant-specific operations such as payment collection. Using a different workspace’s Merchant ID in a collection request returns HTTP 403.Credential rotation and deletion
Regenerating credentials replaces the API Key, API Secret, and Merchant ID together. Existing credentials stop working immediately. Update every integration that uses the old values before regenerating.1
Prepare new credentials
Open the Developer Console and generate a new credential pair. Record both values securely.
2
Update all integrations
Deploy the new API Key and API Secret to every service, worker, and scheduled job that calls the MasterID API.
3
Verify every integration
Send a low-risk request (for example, GET /wallet or GET /catalog) from each service to confirm the new credentials are active.
4
Remove old values
Delete the old API Key and API Secret from secret stores, environment variables, and configuration files. If you use a secret manager, mark the old version as deprecated or delete it.
5
Delete or rotate the webhook secret if needed
The webhook signing secret is separate from API authentication. It cannot be used as an API Secret. To replace it, delete the current webhook and add another in the Developer Console.
Webhook signing secret
Webhooks are signed with a separate secret you configure in the Developer Console. To verify webhook signatures, compute an HMAC SHA-256 overtimestamp + '.' + rawBody using the signing secret. See the Webhooks guide for the full verification flow. The webhook signing secret cannot be used as an API Secret.
Troubleshooting
HTTP 401: missing, invalid, or revoked credentials
HTTP 401: missing, invalid, or revoked credentials
- Check that both
X-API-KeyandX-API-Secretheaders are present. - Verify the values match an active credential pair in the Developer Console.
- Confirm the credentials have not been regenerated or deleted since they were last used.
HTTP 403: suspended account or Merchant ID mismatch
HTTP 403: suspended account or Merchant ID mismatch
- Ensure your workspace account is in good standing.
- For collection requests, ensure the
merchantIdmatches the Merchant ID of the authenticated workspace. A different Merchant ID is rejected. - Confirm merchant activation is complete if you are collecting payments.

