Authentication

How it works

Pass your API key as the apiKey argument on each GraphQL operation:

query GetCreditsLeft($apiKey: String!) {
  getCreditsLeft(apiKey: $apiKey) {
    code
    message
    creditsLeft
  }
}

{
  "query": "query GetCreditsLeft($apiKey: String!) { getCreditsLeft(apiKey: $apiKey) { code message creditsLeft } }",
  "variables": { "apiKey": "YOUR_API_KEY" }
}

REST

For POST /create-payment, send apiKey in the JSON body:

{
  "apiKey": "YOUR_API_KEY",
  "amount": 25.5
}

For POST /pay, you may optionally pass apiKey in the body or Authorization: Bearer <token> to use StartPayment instead of the public hosted-checkout starters.

Checkout helpers (POST /pay without auth, GET /orders/:txnid) authenticate by `txnid` ownership on the transaction.

Credit quota

• Invalid or missing key → typically 401
• creditsLeft <= 0 on debiting operations → 402 (credit limit exceeded)
• Check balance with getCreditsLeft (does not debit)
• Purchase more credits via the Argonpay dashboard (credit top-up flow)

Pricing: $1 USDT = 20 credits (minimum top-up 20 credits).

Security notes

• Treat your API key like a password.
• Never commit keys to source control or expose them in client-side browser code.
• Prefer server-to-server calls from your backend.
• Rotate compromised keys with revokeApiKey.