Authentication
All API requests require a valid API key passed in the Authorization header.
API Key format
Your API key starts with oxp_live_ followed by 43 base64url characters. Pass it as a Bearer token.
Authorization: Bearer oxp_live_YOUR_KEY_HERE
Pre-approval mode
New accounts start in pre-approval mode
You get 100 test API calls before our team reviews your account. Each response includes:
X-Oxin-Pay-Approval: pending
X-Oxin-Pay-Quota-Remaining: 99
IP whitelist
Restrict which server IPs can use your API key. Supports individual IPs and CIDR ranges. An empty whitelist allows all IPs.
# Update IP whitelist via dashboard or:
PUT /web/v1/api-keys/whitelists
{
"ips": ["203.0.113.0/24", "198.51.100.5"]
}Domain whitelist
Restrict the domains from which your hosted checkout may be embedded (Referer header check).
Key lifecycle
| State | Description | API calls |
|---|---|---|
| pending_approval | Awaiting admin review | Up to 100 test calls |
| active | Fully approved | Unlimited |
| disabled | Temporarily suspended | Rejected (403) |
| revoked | Permanently revoked | Rejected (401) |
Error responses
| Code | HTTP | Meaning |
|---|---|---|
| missing_api_key | 401 | No Authorization header |
| api_key_not_found | 401 | Key does not exist or hash mismatch |
| api_key_revoked | 401 | Key has been permanently revoked |
| api_key_disabled | 403 | Key is temporarily disabled |
| ip_blocked | 403 | Calling IP not in whitelist |
| quota_exceeded | 403 | Pre-approval call limit reached |