Skip to main content

Authentication

In-store requests are made server to server and authenticated with an API key. The key identifies your business, so every request acts on your own data and nothing else.

Your API key​

An API key looks like this:

bndl_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

You create keys in the Boundless dashboard. The full value is shown once, at creation — store it in your server's secret manager. If a key is lost or exposed, revoke it and create a new one; keys can be rotated without downtime.

Keep keys server-side

An API key can take payments in your name. Never ship it in a browser, a mobile app, or anything a customer can reach. All in-store calls are made from your backend.

Sending the key​

Send the key in the X-API-Key header:

curl https://api-live.kcpboundless.com/api/in-store/payments \
  -H "X-API-Key: bndl_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

If your HTTP client is easier to use with a bearer token, an Authorization header carrying the same key is also accepted:

curl https://api-live.kcpboundless.com/api/in-store/payments \
  -H "Authorization: Bearer bndl_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Use one or the other. A request with no valid key is rejected with 401 Unauthorized.

What a key can do​

A key is scoped to your business. It can take in-store payments, check their status, and manage your own stores and terminals. It cannot reach another business's data — a request that names a store or payment you do not own is rejected as not found.

Rate limits​

Requests are rate limited per key. Within normal point-of-sale volumes you will not encounter the limit; if a burst exceeds it, requests return 429 Too Many Requests and can be retried after a short pause. If you need a higher limit for a key, ask Boundless.