Part 1

Environment and authentication

Base URL, required headers, API key scopes, key storage and rotation.

Environment

The base path of every endpoint is /api/v1. The planned production host is https://api.antarapay.com. Use the base URL AntaraPay gives you at activation; the sandbox address is not defined in this contract.

Do not add /api/v1 twice to the URL. If ANTARAPAY_BASE_URL already contains /api/v1, do not append it again in the path.

Headers

Header	Rule
`Authorization`	`Bearer <api_key>`; required on every endpoint in this guide except incoming webhooks to your server.
`Content-Type`	`application/json` for requests with a JSON body.
`Idempotency-Key`	Required on every POST. Use a unique value per business operation and keep it for retries.
`Accept`	`application/json`; use `image/png` for the GET QR image.

Example request

curl "$ANTARAPAY_BASE_URL/api/v1/balances" \
  -H "Authorization: Bearer $ANTARAPAY_API_KEY" \
  -H "Accept: application/json"

API key scopes

Scope	Operations
`payins:write` / `payins:read`	Create payins / read the list, details, and QR.
`payouts:write` / `payouts:read`	Create or cancel payouts / read payouts.
`balances:read` / `journals:read`	Read balances / journals.
`settlements:read` / `channels:read`	Read settlements / channels.
`reports:write` / `reports:read`	Request an export / read export status.

Key storage and rotation

API keys are for server-to-server use only. Never put a key in frontend JavaScript, a mobile app, source control, a URL, or a log. Use a secret manager or your backend environment. Sandbox and production use different credentials. Revoke a leaked key and rotate it through the integration dashboard.

Every key is bound to one merchant. You do not need to send merchant_id in the body. Another merchant's resources cannot be accessed even if the ID is known. An insufficient scope returns 403; a wrong or revoked key returns 401.

Merchant dashboard

The dashboard is used to monitor transactions, balances, journals, reports, and integration settings. In v1, payins and payouts are created through the API. The client API does not grant admin approval or manual transfer execution.