Authentication
Authenticate requests, manage keys, and select an environment.
Send your API key in the X-API-Key header. The key identifies your business, so
requests do not include a business ID.
curl https://engine-api.pilot.pulseshiga.io/v1/banks \
-H "X-API-Key: <your key>"A request without a valid key returns 401 with the code unauthorized.
Keep your key on the server
The key can create orders and move money. Store it only on your server. Rotate it after any exposure.
Create and rotate keys
Manage keys in the Dashboard.
Select the test or live environment before you create or rotate a key. The
Dashboard shows a new secret key once. Store it before you close the dialog. Use
the secret key in X-API-Key.
Rotation invalidates the old key immediately. If you need both credentials to work during deployment, create a separate key, deploy it, confirm traffic uses it, then rotate the old key. If a key is exposed, rotate it immediately and update every service that used it.
Environments
You get a separate key for each environment. Build in the test environment, then switch to the live environment.
| Environment | Webhook value | Base URL |
|---|---|---|
| Test | test | https://engine-api.pilot.pulseshiga.io |
| Live | live | https://engine-api.pulseshiga.io |
Every path starts with /v1. Send JSON with Content-Type: application/json.
The examples in these guides use the test base URL. In the
API reference, the request runner has a server
selector for the test and live environments.
See API conventions for the response shape, amounts, and safe retries.