Authentication
Every request is signed with your store's private API key in the x-api-key header:
curl "https://api-stage.st-payup.com/v1/stores" \
-H "x-api-key: pr_5d843b3a990f437fb03df5d510599bf2"
Getting a key
- Sign in to the merchant dashboard and open API keys.
- Choose Issue new keys. The registration already created a first pair that nobody has seen, so issuing replaces it: the old keys stop working at once.
- Copy the private key (
pr_…). It is shown once; the dashboard keeps only a mask.
What a key can do
- Take payments for its store, manage payment links, and read the store's transactions, settlements and terminals.
- It cannot issue keys, change a password or reach anything an account owner does in the dashboard. A key found by a third party can take a payment, not take over your account.
- The public key (
pb_…) is not accepted; keep the private key on your server, never in a browser or mobile app.
Answers you will see
| Status | Meaning |
|---|---|
| 401 | The key is missing, unknown, expired or public. |
| 403 | The key is valid but may not use that endpoint. |
| 503 | The key could not be checked right now; retry. |
Lists
Every list answers { "data": [...], "page": 1, "size": 20, "total": 91 }. An empty list is "data": []. Ask for pages with page and size.