Authentication and API keys
Create a merchant API key, choose its scopes and send it with each request.
Merchant API requests go to:
https://apps.apiswop.co/api/v5/merchantEvery request carries a merchant API key. A key acts as your account, limited to the scopes you gave it.
Create a key
Open the Swop web app and go to Dashboard → Developer.
Under Create an API key, name the key and tick its scopes.
Copy the secret. It starts with swop_sk_ and is shown once. If you lose it, revoke the key and create a new one.
Scopes
Give each key only what it needs.
commerce.card is checked when each request is made. If you ticked it but your account isn't verified for card yet, the key works for everything else and leaves card out of effectiveScopes.
Send the key
Use the Authorization header (or X-API-Key):
curl https://apps.apiswop.co/api/v5/merchant/me \
-H "Authorization: Bearer $SWOP_MERCHANT_KEY"Keep it on your server
A key in the browser is a public key
Never put swop_sk_… in HTML, browser JavaScript or a mobile app. Keep it in a server environment variable such as SWOP_MERCHANT_KEY, and have your server call Swop.
Some actions can't be done with a key at all. Creating or revoking keys, registering websites that may frame your checkout, and changing webhooks only happen in the Swop app while you're signed in. A leaked key therefore can't lock you out or redirect your webhooks.
When auth fails
| Status | Meaning |
|---|---|
401 | No key, or the key is invalid or revoked. The message is the same either way, so nobody can probe which keys exist. |
403 | The key is valid but lacks the scope this endpoint needs. The body lists grantedScopes and effectiveScopes. |
403 ACCOUNT_FLAGGED | The account is restricted. |
More in Errors.