Authentication
Authenticate requests, manage keys, and select an environment.
Send your API key in the X-API-Key header. The key identifies your business, so
requests do not include a business ID.
curl https://engine-api.pilot.pulseshiga.io/v1/banks \
-H "X-API-Key: <your key>"A request without a valid key returns 401 with the code unauthorized.
Keep your key on the server
The key can create orders and move money. Store it only on your server. Rotate it after any exposure.
Create and rotate keys
Manage keys in the Dashboard.
Select the test or live environment before you create or rotate a key. The
Dashboard shows a new secret key once. Store it before you close the dialog. Use
the secret key in X-API-Key.
Rotation invalidates the old key immediately. If you need both credentials to work during deployment, create a separate key, deploy it, confirm traffic uses it, then rotate the old key. If a key is exposed, rotate it immediately and update every service that used it.
Base URLs
You get a separate key for each environment. Build in the test environment, then switch to the live environment.
| Environment | Webhook value | Base URL |
|---|---|---|
| Test | test | https://engine-api.pilot.pulseshiga.io |
| Live | live | https://engine-api.pulseshiga.io |
Every path starts with /v1. Send JSON with Content-Type: application/json.
The examples in these guides use the test base URL. In the
API reference, the request runner has a server
selector for the test and live environments.
Responses
Every response has the same shape. A success returns status: true and a data
object. A failure returns status: false with an error string and a code.
{
"status": true,
"data": { }
}Check status first. When it is false, match on code and display error. See
Errors and retries for the complete code list.
Amounts
Send and read amounts as decimal strings, such as "150000". Use a decimal type
for calculations to avoid precision loss.