Authentication
Bearer key plus a timestamp on every call; an HMAC signature on every mutation.
Every request carries your API key as a Bearer token plus a Unix timestamp. Reads need those two headers; all mutating calls are additionally body-signed, so a tampered payload is rejected before it reaches a provider.
| Header | When | Value |
|---|---|---|
Authorization | Always | Bearer poc_live_<64-hex> |
X-Timestamp | Always | Unix epoch seconds — must be within ±5 minutes of server time |
X-Signature | POST, DELETE | HMAC-SHA256 of the canonical message |
Key format
Keys are issued as poc_live_ followed by 64 hex characters. Only a hash is stored on our side, so a lost key cannot be recovered — revoke it and issue another. A key also carries its own permission set, IP whitelist and per-minute rate limit; all three are enforced before your request reaches a product.
A server more than five minutes off NTP fails every call with EXPIRED_TIMESTAMP, no matter how correct the signature is.
Rate limits
Each key carries its own per-minute quota, 60 requests per minute by default, counted per key rather than per IP. Exceeding it returns 429 with RATE_LIMITED, and the message states the limit that applied. Back off and retry after 60 seconds; the quota is a rolling bucket, not a fixed window, so it refills continuously. If your volume needs a higher ceiling, ask us to raise it on the key rather than spreading calls across several keys.
Permissions
A key is granted any combination of transfer (Free DMT), bills (BBPS), verify (Verification) and query (read-only). Money endpoints check the scope and return 403 FORBIDDEN without it; read endpoints such as /balance, /categories and the status lookups need only a valid key. Every endpoint page states which scope it requires, so grant a key the narrowest set that covers the calls you actually make.