Base URL
Test and live environments use the same base URL. The key prefix determines the environment.
Availability
Not every endpoint in this reference is available to every account:
Authentication
The widget API uses two authentication schemes. Every endpoint page in this reference declares the scheme it needs in its Authorizations section.
API keys
You have two kinds of API key, both found on the API keys page of your MoonPay dashboard:
_test_ keys operate against the sandbox, _live_ keys against production. Test and live data are fully separate.
Never expose a secret key in client-side code, mobile apps, or version
control. Anyone holding it can read your customers’ transaction data.
Publishable key (query parameter)
Currencies, quotes, limits, network fees, and single-transaction lookups authenticate with your publishable key as the apiKey query parameter:
GET /v3/countries works without a key; passing one tailors availability to your account’s configuration.
The server-to-server endpoints and GET /payments/v1/payment-method-config authenticate with your secret key in the Authorization header, using the Api-Key prefix:
URL signing
Widget URLs that carry sensitive query parameters require a signature parameter, computed with your secret key. This is separate from API authentication. See URL signing.
