> ## Documentation Index
> Fetch the complete documentation index at: https://dev.enterprise.moonpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Access

> Obtain and manage API keys for authenticating with the MoonPay Enterprise API. Covers Sandbox and Production environments, key creation, and permissions.

To access the MoonPay Enterprise API, you need to include a valid API key with each request. The API key acts as a unique identifier for secure communication between your application and the API.

## Environments

The API offers two environments: Sandbox and Production. The Sandbox environment is designed for testing and experimentation, letting you simulate API interactions without affecting real data. The Production environment handles live operations and requires verified credentials. Throughout this documentation, API endpoint references default to the Sandbox environment.

### Sandbox

* **API Base URL:** `https://api.sandbox.iron.xyz/api`
* **Partner Dashboard:** [https://app.sandbox.iron.xyz](https://app.sandbox.iron.xyz)

### Production

* **API Base URL:** `https://api.iron.xyz/api`
* **Partner Dashboard:** [https://app.enterprise.moonpay.com](https://app.enterprise.moonpay.com)

## Managing API Keys in the Partner Dashboard

You can create and manage API keys in the [Partner Dashboard](/partner-dashboard).

1. Log in to the Partner Dashboard.
2. Navigate to **Developer → API Keys**.

### Creating an API Key

When creating a new API key, you need to provide the following details:

* **Role**: Define the key's permissions:

  * **Read Only**: Read-only access.
  * **Read / Write**: Read and write access.

* **Label**: A descriptive name to help you identify the key, especially if you manage multiple keys.

### Revoking an API Key

You can revoke an API key at any time through the Partner Dashboard.

## Using an API Key

Once you’ve created an API key, include it in the `X-API-Key` header of each request.

### Example Request

Here’s an example using `curl` to fetch a list of customers:

<CodeGroup>
  ```bash Bash theme={null}
  curl --request GET \
       --url https://api.sandbox.iron.xyz/api/customers \
       --header 'X-API-Key: <your-api-key>' \
       --header 'Accept: application/json; charset=utf-8'
  ```
</CodeGroup>

<Note>
  Include the `X-API-Key` header in every request. Replace `<your-api-key>` with the key you generated in the Partner Dashboard.
</Note>

<Info>
  Every endpoint under `/api` also reads an optional `X-API-Version` header that pins response shapes to a dated API version. Omit it and you get the default version. See [API Versions](/versioning).
</Info>

## Rate Limiting

MoonPay Enterprise applies multiple layers of rate limiting for fair usage and system stability. This includes per-API-key limits for authenticated requests as well as infrastructure-level protections against unauthorized access attempts and abuse.

When rate limits are exceeded, the API returns an HTTP `429 Too Many Requests` status code. Your application should handle this response appropriately, typically with exponential backoff retry logic.

If you have specific requirements or anticipate high-volume usage, contact our team to discuss your needs.

## Errors

| Status | Cause |
| - | - |
| 401 | Missing or invalid `X-API-Key` |
| 403 | Partner account is not active |
| 429 | Rate limit exceeded |

Client errors (`401`, `403`, `429`) return a plain JSON string:

```json 401 Unauthorized theme={null}
"Missing or invalid authentication. Please provide X-API-Key"
```

```json 403 Forbidden theme={null}
"Partner is not active. Please contact iron support"
```

```json 429 Too Many Requests theme={null}
"Rate limit exceeded"
```

Server errors (`500`) return `{ "message": "...", "trace_id": "..." }`. Reference the `trace_id` when reporting issues.

## MCP Server

MoonPay Enterprise publishes an MCP server: [`@ironxyz/mcp-server`](https://www.npmjs.com/package/@ironxyz/mcp-server).

Point an MCP-aware editor at it and a single prompt runs end to end. In Cursor:

1. Cursor locates the MoonPay Enterprise MCP server.
2. It retrieves a summary list of all available endpoints and identifies the correct one to use.
3. It fetches the complete OpenAPI specification for the selected endpoint.
4. It implements a full Golang backend based on that spec.
5. It makes a real API call to the sandbox endpoint and returns the live response within the Cursor chat.