Basics
Authorization
How to sign API requests with your API token
Every API request must carry your API token in the X-Api-Token HTTP header:
X-Api-Token: YOUR_API_TOKENDo not use the Authorization header shown in the OpenAPI (Swagger) documentation. Only X-Api-Token is accepted; requests without it are rejected.
Getting a token
Your manager issues the API token together with your merchant account. The same token is used for:
- signing every API request (
X-Api-Tokenheader); - verifying webhook signatures (
X-Signatureheader), see Order status and webhooks.
Treat the token as a secret. Do not commit it to source control or expose it in client-side code. If the token leaks, ask your manager to rotate it immediately.
Base URL
All endpoints in this documentation are relative to:
https://api.riopay.onlineCheck that it works
Request your merchant balance. A valid token returns your merchant account details:
curl -X GET "https://api.riopay.online/v1/merchants/balance" \
-H "X-Api-Token: YOUR_API_TOKEN"