API Reference

The MP Merchant API is a REST API. All requests return JSON. Authentication uses HMAC-SHA256 signed Bearer tokens. Use mk_test_ keys for development and mk_live_ keys for production.

Base URLs

Authentication

All API endpoints (except merchant registration and the hosted checkout page) require an Authorization header with an HMAC-SHA256 signed Bearer token.

Authorization: Bearer {key_id}:{unix_timestamp}:{hmac_sha256_signature}

# HMAC message: "{key_id}.{unix_timestamp}"
# HMAC key: your secret

See the Authentication page for complete signing examples in Node.js, Python, Go, and cURL.

Rate limits

60 requests per minute per API key. When exceeded, the API returns HTTP 429 with a Retry-After header.

Pagination

All list endpoints use offset-based pagination via limit and offsetquery parameters. Responses include a total field.

GET /v1/orders?limit=20&offset=40   # Page 3

Errors

Errors return a JSON object with a single error string and an appropriate HTTP status code. See the Error Reference for the full list.

{"error": "order not found"}