Skip to main content

Authenticating Requests with API Keys

To make successful requests to the MoonPay Enterprise API, you must authenticate every request by including a valid API key in the request headers. Authentication ensures that only authorized users can access resources or perform actions within the API. Learn how to generate API Keys here.

Including the API Key

Include your API key in the X-API-Key header of every request. If the API key is missing, incorrect, or revoked, the request will fail.

Example Request

The following example demonstrates how to use your API key with a GET request to fetch a list of customers:
Replace YOUR-API-KEY with the actual API key you generated. The X-API-Key header is required for every request to authenticate your access. This example uses the Sandbox base URL. For Production, send requests to https://api.iron.xyz. See API Access for both environments.

Handling Authentication Errors

If the API key is missing, invalid, or revoked, the server responds with a 401 Unauthorized error. All three cases return the same response:
Unlike other API errors, authentication failures return a plain-text body, not JSON. Don’t parse the 401 response body as JSON.

Common Causes of Authentication Errors

  1. Incorrect API Key: Ensure the key matches the one you generated.
  2. Revoked API Key: Verify that the key has not been revoked.
  3. Missing API Key: Confirm the X-API-Key header is included in your request.

How to Resolve

  • Double-check the API key and its permissions in the Partner Dashboard.
  • Generate a new key if necessary and update your requests with the new key.