Getting Started
Authentication

Authentication

  • Base URL: https://api.abstrapay.com
  • Operator endpoints — server-to-server calls you make directly. These require Authorization: Bearer <OPERATOR_SECRET_KEY> (we provision this key for you — keep it server-side only): /session/create, /depositor/create, and /depositor/:externalUserId/check.
  • Session-scoped endpoints — /depositor/address and /withdraw/direct-transfer are called by the hosted widget, not your backend. They take no Bearer key; they are authenticated by the sid (session id) in the request body.
  • The same OPERATOR_SECRET_KEY signs/verifies all webhooks.
  • Response shape: the operator/session endpoints (/session/create, /depositor/address, /withdraw/direct-transfer) wrap their result as { "status", "message", "data": { … } }. GET /chain and the /admin/* endpoints return the raw object/array (no envelope).
Quick StartDeposits