Authentication
Every request carries the key of a shop:
Authorization: Bearer <shop_key>
| Key | Host |
|---|---|
psbox_… |
Sandbox https://payments-api.mrcr.io only |
plive_… |
Production https://payments-api.mercuryo.io only |
Key format
plive_1024_8Kq2xVb7Lm4Pq9Rt3Wz6Yc1Hd5Jf0Ns2Ue8Ga7Xk
└─┬─┘ └┬─┘ └──────────────────┬───────────────────┘
│ │ └ secret, 40 letters and digits
│ └ shop_id — the shop the key belongs to
└ environment: plive (production) or psbox (sandbox)
The prefix and the shop_id show which environment and shop a key is for. Store and send the key
whole, as one string, and keep it secret like a password.
Errors
| HTTP | code |
When |
|---|---|---|
| 401 | authentication_failed |
The key is missing, malformed or revoked, or sent to the other environment's host |
Getting a key
Mercuryo issues a key for each shop, together with its shop_id and webhook signing secret.
Next: Transactions
