API Authentication

The DirectCryptoPay Public API uses API keys to authenticate requests. There are two types of API keys, each for different use cases.

Key Types#

Type	Prefix	Purpose
Public API Key	`dcp_pk_live_` / `dcp_pk_test_`	External REST API access (`/api/v1/`)
Integration Key	`dcp_live_` / `dcp_test_`	Widget/SDK authentication (tied to an integration)

Public API Keys are what you need for programmatic access from your backend, Zapier, AI agents, or custom scripts. Integration keys are only for the embeddable widget and SDK.

Generating a Public API Key#

Log in to your Dashboard
Navigate to Settings > API Keys
Select the Public API Keys tab
Click Generate API Key
Choose a name, select scopes, and optionally set an expiration date
Copy the key immediately -- it's only shown once

Save your key securely. The full key is only displayed once at creation time. If you lose it, you'll need to generate a new one.

Authentication Methods#

Include your API key in requests using either method:

X-API-Key Header (Recommended)#

curl https://api.directcryptopay.com/api/v1/payment-links \
  -H "X-API-Key: dcp_pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Authorization Bearer#

curl https://api.directcryptopay.com/api/v1/payment-links \
  -H "Authorization: Bearer dcp_pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Scopes#

Public API keys are scoped to limit access. Available scopes:

Scope	Access
`payments:read`	Read payment links, payment intents, and payments
`payments:write`	Create new payment links
`events:read`	Read events and webhook delivery logs

You choose scopes when creating the key. A key with only payments:read cannot create payment links.

Rate Limits#

The Public API is rate-limited to 60 requests per minute per API key. If you exceed this limit, you'll receive a 429 Too Many Requests response.

HTTP/1.1 429 Too Many Requests
Retry-After: 60

Key Lifecycle#

Active: Key is valid and accepting requests
Expired: Key has passed its expiration date and is automatically rejected
Revoked: Key was manually revoked from the dashboard and is permanently invalid

Revocation is immediate and irreversible. Any in-flight requests using a revoked key will fail.

Security Best Practices#

Never expose keys in client-side code -- API keys should only be used server-side
Use environment variables -- Store keys in .env files or your platform's secret manager
Set expiration dates for keys used in temporary integrations
Use minimal scopes -- Only grant the permissions your integration needs
Rotate keys periodically -- Revoke old keys and generate new ones regularly

# .env (do not commit this file)
DCP_API_KEY=dcp_pk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Next Step: See the API Endpoints documentation for available routes and examples.

Previous Gas Fees Next Endpoints