Authorization
To meet security standards, all API calls require an authorization token. After receiving the credentials from Coinme, the Partner can get the Authorization token using the Authorize endpoint.
The Authorization Token needs to be cached and passed with each subsequent call. It is required per partner, not per individual customer.
| Environment | Time to Live |
|---|---|
| Production | 60 minutes |
| Staging | 30 minutes |
FAQ: What is the difference between staging and production environments?The staging environment is designed for integration testing using test data and simulated transactions. The production environment processes real funds and real users. Credentials are separate for each environment and are provisioned during your onboarding process. Please note that for some configurations, staging access is deactivated once production is enabled. If you need continued staging access post-launch, request this from your partner manager in advance.
Sample API Request: POST
URL: https://caas-staging.coinme.com/services/authorize
headers:
'User-Agent: partnerapi',
'Content-Type: application/x-www-form-urlencoded',
'Authorization: Basic *****************'The partnerId is used for the Username field and clientsecret is used for the Password field
After receiving the Authorization token, the Partner can call the Coinme APIs with the Authorization JWT token in the header.
FAQ: I'm getting a 1020 error or 403 Forbidden on API requests. Why?A 1020 or 403 response indicates that the request was blocked by our web application firewall. Common causes include missing or malformed request headers, requests from IPs that have not been whitelisted, or request patterns that trigger rate-limiting. Please confirm that all required headers are included (especially authorization and device fingerprint headers) and that your server IP has been whitelisted for the appropriate environment.
Updated about 2 months ago