Authentication

All x402 API requests require your merchant API key.

Send it in the Authorization header — no Bearer prefix, just the raw key:

Authorization: <merchant-api-key>

Example:

curl -X POST "https://facilitator.ivorypay.io/api/x402/initiate" \
  -H "Authorization: $IVORYPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 0.01,
    "token": "USDC",
    "network": "BASE_MAINNET",
    "resourceUrl": "https://yourapp.com/premium-content",
    "resourcesDescription": "Access to premium content"
  }'

Keep Keys Server-Side

Do not expose your merchant API key in browser code, mobile apps, or public repositories.

Recommended pattern:

1. Your frontend requests paid access from your backend.

2. Your backend calls Ivorypay x402 using the merchant API key.

3. Your backend returns only the x402 payment payload needed by the client.

4. Your frontend asks the customer wallet to sign.

5. Your backend submits the signed payment payload.

Missing API Key

If the Authorization header is missing, the API returns an error:

{
  "message": "Please provide your api key",
  "error": "Bad Request",
  "statusCode": 400
}