Authentication

Every request identifies your account with a public key:

X-Public-Key: pk_your_public_key
Content-Type: application/json

The key is safe to ship in a browser bundle. It can create payments and read a payment by its ID, but it cannot move money, change your settlement wallets, or reach another merchant’s data. Account-wide reads use your API key and secret instead.

curl https://hub.stablezact.com/api/v1/networks \
  -H "X-Public-Key: pk_your_public_key"

API key and secret

Account-wide reads, the payment list (/payments/merchant/list) and payment stats (/payments/merchant/stats), authenticate with your API key and secret, from Dashboard, Settings, API:

X-API-Key: your_api_key
X-API-Secret: your_api_secret
Content-Type: application/json

• Send them from your server only. The secret must never reach a browser.
• Send these two headers without X-Public-Key. When a public key is present, the request is authenticated with the public key instead.
• The key and secret always read live-mode data.

curl https://hub.stablezact.com/api/v1/payments/merchant/stats \
  -H "X-API-Key: $STABLEZACT_API_KEY" \
  -H "X-API-Secret: $STABLEZACT_API_SECRET"

Calls to these two routes with only a public key still work for now, and the response carries a Deprecation: true header. Move them to the API key and secret. Integrations that already send the key and secret on every request keep working.

Missing or invalid credentials

{
  "error": "API credentials required. Use x-public-key header or x-api-key and x-api-secret headers."
}

Returned with 401.