USDTPay

API Authentication

Every merchant API request carries a secret key as a bearer token:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  • Keys are shown once at creation and stored only as a SHA-256 hash.
  • Revoked and expired keys return 401 invalid_api_key.
  • Keys are scoped to one merchant and one environment; every resource you fetch is filtered by both.
  • Rotate a key from the dashboard: a new secret is issued and the old one revoked in the same operation.

Check a key with:

curl https://api.usdtpay.ge/api/v1/me -H "Authorization: Bearer sk_test_xxx"

Rate limits

Requests are limited per API key, per merchant and per IP (defaults: 120 / 300 / 60 per minute). Exceeding a limit returns 429 rate_limit_exceeded with a Retry-After header.

Request IDs

Every response carries X-Request-ID. Send your own (X-Request-ID: my-trace-123) to correlate logs, and quote it when contacting support.