Skip to main content
POST
cURL
Some Platform API capabilities must be enabled on your account by MoonPay before you can call them. If this endpoint returns an unexpected 404, see Capability enablement.

Authorizations

X-Api-Key
string
header
required

Secret key authentication via the X-Api-Key header.

Example: X-Api-Key: <secretKey>

Body

application/json
deviceIp
required

The IP address of the user's device to ensure the integrity of the session. Both IPv4 and IPv6 values are supported.

Example:

"0.0.0.0"

externalCustomerId
string

A unique identifier for the customer from your system.

Required string length: 1 - 255
Example:

"user_01AN4Z07BY"

email
string<email>

The customer's email address. Must be a valid email. If provided, enables email OTP authentication.

Required string length: 5 - 255
Example:

"user@example.com"

phoneNumber
string

The customer's phone number in E.164 format. If both email and phone are provided, enables phone OTP authentication for returning customers.

Pattern: ^\+[1-9]\d{1,14}$
Example:

"+14155551234"

termsAcceptedAt
string<utc-date-time>

An ISO 8601 timestamp of when the customer accepted MoonPay's Terms of Use. Send this when you capture Terms of Use acceptance in your own UI. The value can be at most 60 seconds ahead of server time, with no past limit. MoonPay records the terms version live at this timestamp and binds the acceptance to the customer when the session is authorized. Only send this field if you use the Customer API or Guest Checkout; otherwise the request fails with a 503 service_unavailable error.

Example:

"2026-05-28T14:21:00.000Z"

Response

The request has succeeded.

sessionToken
string
required

An opaque session token used to set up a connection on your frontend. This token is single-use and must be generated each time the customer visits your app.

Token expires 24 hours after issuance.

Required string length: 1 - 8192
Example:

"c2Vzc2lvbi50b2tlbg"