Skip to main content

​
Base URL

​
Authentication

All API requests must include your API key in the api-key header:
Your API key is available in the Noxpay dashboard under Settings → API Keys. The key identifies your account, and your account scopes every request: reads are filtered to your own transactions and writes are recorded against your account. There is no way to reach another account’s data.
Never expose your API key in client-side code. All requests to the Noxpay API must originate from your backend.
An API key authenticates your account — it does not restrict which operations can be performed. There is no read-only API key: any valid key can create a checkout or accept a conversion. Treat every key as full-access and scope access at your own layer.
Every authenticated response carries an X-API-Version header with the current build tag.

​
Request format

Every POST endpoint rejects unknown fields. A typo’d or extra key in the request body returns 400 rather than being silently ignored — so a request that used to work will not start behaving differently after a field is renamed. Query parameters behave the opposite way: an unrecognised parameter on a GET is ignored, and an unparseable value for a known parameter is generally dropped rather than rejected. See the individual endpoint pages for the specifics.

​
Status codes

​
Error responses

Error body format is not uniform, so branch on the HTTP status rather than on the body. Three shapes exist:
  1. A JSON object, correctly typed — the conversion endpoints:
    On a refusal, POST /v2/rfq/accept instead returns its full response object, carrying state and reason.
  2. A JSON object sent with Content-Type: text/plain — POST /v2/crossramp_checkout. The body is still JSON despite the header, so parse the body and ignore the content type.
  3. No body at all — the single-record and list GET routes write only the status line on 401, 404, and 500.
Treat the error body as optional enrichment. A robust client decides what happened from the status code, then reads a body if one is present.