Skip to main content
Two auth models:
  • API key: for creating checkout sessions and all off-ramp and onramp endpoints
  • None: for session status, payment link info, and payment link session creation
The Wallet API is a separate product with its own wsk_live_ keys, generated from Dashboard → Wallets rather than API Keys. See its own docs for details; the rest of this page covers the ms_live_ key used everywhere else.

​
API key

All keys use the ms_live_ prefix.
Never put your API key in frontend JS, mobile apps, or public repos. Backend only.

​
Example

​
Generate a key

  1. Open merchant.minisend.xyz/dashboard.
  2. Go to API Keys → New Key.
  3. Copy the full value immediately; it’s shown once. Minisend stores only a hash.
401 = invalid or missing key. 403 = the key or account can’t use this endpoint yet — see key scopes below.

​
Key scopes

Two independent things gate access to checkout, off-ramp, and onramp: your key’s scope, and whether the product is enabled on your account. Both must be true, or every call to that product returns one friendly 403:
The error message doesn’t distinguish between a missing scope and a disabled account — either way, requesting access is the fix.

​
Rate limits

Every authenticated request is capped at 60 requests / minute / IP. The response includes X-RateLimit-Remaining; exceeding it returns 429. On top of that, endpoints that move money or fire a real payment prompt carry their own tighter, per-merchant limit (keyed to your account, not your IP, so it can’t be dodged by rotating addresses): Onramp additionally caps at 5 payment prompts per phone number per 10 minutes, regardless of which key or account is calling — a 429 here means that specific phone was just sent one recently, not that your account is throttled. Contact support for higher limits.

​
Public endpoints

No Authorization header needed: Safe to call from a browser or mobile app.