Skip to main content
The Merchants API authenticates requests with an API key. Send the key on every request in the X-API-KEY header (OpenAPI security scheme ApiKeyAuth). Some write endpoints also require HMAC request signing (X-API-Nonce and X-API-Signature). Those requirements are declared per operation in the interactive API reference.

​
Create an API key

  1. Open the merchant dashboard and go to Settings → API & Webhook → API Keys: https://merchants.zbx.boomfi.xyz/dashboard/settings/api-keys
  2. Create a new key.
  3. Copy the secret immediately and store it in a secrets manager.
ZBX shows the full API key once at creation and cannot recover a lost key. Rotate (create a new key and revoke the old one) if it is leaked.

​
Send the key

Keep keys out of client-side code, public repos, logs, and screenshots.

​
Request signing (when required)

Permanent pay-in address creation and crypto payouts require HMAC request signing in addition to the API key. Other writes may only need X-API-KEY: check each operation in the API reference for ApiNonce / ApiSignature. How the signature is built, how to fetch the signing secret, and a code sample are documented in the full guide: Authentication.

​
Webhook verification is separate

Inbound webhooks use an asymmetric public key for payload verification: not the API key and not the HMAC request-signing secret. See Verify Webhook Signatures.

​
Next