Authentication

Merchant API key

Create a Merchant API key under Business profile → Developers → API Keys. You need the Owner, Admin, or Developer role. The key belongs to the organization, not to the person who created it. For the steps, see Developer Settings.

curl https://merchant-api-prod.anyway.sh/v1/me \
  -H "X-API-Key: ak_YOUR_API_KEY"

GET /v1/me returns the key’s orgId, apiKeyId, and permissions. Merchant API keys are server-side credentials.

Permissions

Each Merchant API key has either Full access or Limited access:

Full access can call every Merchant API endpoint, including endpoints added later. GET /v1/me shows it as "permissions": []. All existing keys, and keys created from the CLI, have full access. Creating one from the CLI needs a role with every permission.
Limited access can call only the endpoints covered by the permissions you choose (table below).

Set the access level when you create or edit a key under Developers → API Keys (how). A change applies from the key’s next request. You can grant only permissions your own role has. To grant Full access, your role needs every permission in the table. In the dashboard, :read permissions are under Can read and :write permissions under Can create and change.

Permission	Endpoints
Orders `sales:orders:read`	`GET /v1/orders` `GET /v1/orders/{id}` `GET /v1/orders/{id}/events` `GET /v1/entitlements/check`
Subscriptions `sales:subscriptions:read`	`GET /v1/subscriptions` `GET /v1/subscriptions/{id}` `GET /v1/subscriptions/{id}/events`
Cancel subscription `sales:subscriptions:write`	`POST /v1/subscriptions/{id}/cancel`
Refunds `sales:refunds:read`	`GET /v1/refunds` `GET /v1/refunds/{id}`
Checkout sessions `sales:checkout_sessions:read`	`GET /v1/checkout-sessions/{id}`
Checkout sessions `sales:checkout_sessions:write`	`POST /v1/checkout-sessions` `POST /v1/checkout-sessions/{id}/expire`
Products `products:products:read`	`GET /v1/product` `GET /v1/product/{id}`
Products `products:products:write`	`POST /v1/product` `PATCH /v1/product/{id}` `POST /v1/product/{id}/archive` `POST /v1/product/{id}/publish`
Payment links `products:payment_links:read`	`GET /v1/product/{id}/payment-links`
Payment links `products:payment_links:write`	`POST /v1/product/{id}/payment-link` `PATCH /v1/payment-links/{linkId}`
Customers `customers:customers:read`	`GET /v1/customers` `GET /v1/customers/{id}`

A request to an endpoint without its permission returns 403 with the error code INSUFFICIENT_SCOPE. Nothing is created or changed.

{
  "success": false,
  "message": "Forbidden",
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "this API key does not have sales:checkout_sessions:write"
  }
}

Agent Wallet Key

An Agent Wallet Key is a P-256 signing bundle created for one agent wallet:

export ANYWAY_AGENT_WALLET_KEY="<base64url key bundle>"
anyway wallets agents whoami

The CLI signs each Agent Wallet API request. Advanced direct clients send:

Header	Value
`X-Agent-Pubkey`	Base64 SPKI P-256 public key
`X-Agent-Timestamp`	Current Unix timestamp
`X-Agent-Signature`	Base64 DER ECDSA signature

The signature covers the SHA-256 digest of:

METHOD
/request/path
unix_timestamp

Prefer the CLI unless you specifically need to implement this protocol.

Telemetry key

Agent Traces API keys authorize SDK export to the collector. Store them in environment variables or a secrets manager and redact them from spans.

Never expose any secret in browser code, public source, model prompts, traces, screenshots, or support messages. Rotate a key immediately if its value may have leaked.

Start

Merchant API

Merchant API endpoints

Developer contracts

Code & telemetry

Authentication

Merchant API key

Permissions

Agent Wallet Key

Telemetry key

​Merchant API key

​Permissions

​Agent Wallet Key

​Telemetry key

Merchant API key

Permissions

Agent Wallet Key

Telemetry key