Authentication - WalletConnect Pay Docs

Documentation Index

Fetch the complete documentation index at: /llms.txt

Use this file to discover all available pages before exploring further.

Every request to the WalletConnect Pay API is authenticated with an API key, passed in the Api-Key header:

curl "https://api.pay.walletconnect.com/v1/merchants" \
  -H "Api-Key: $WCP_API_KEY"

API keys are created and managed in the dashboard. A key is shown only once at creation — store it in a secret manager. Anyone with the key can act on behalf of your account.

Test and live keys

Your account has two kinds of keys, one for each mode:

Key prefix	Mode	Behavior
`wcp_test_`	Test	Payments are simulated; no funds move. See Test mode.
`wcp_`	Live	Real payments with on-chain settlement.

The key is the only thing that selects test or live. Both key types work against the same base URL and the same endpoints, and there is no test flag or mode parameter on any request.

Responses do not say whether a resource is test or live — that’s determined by the key that created it.

Errors

Status	Meaning
`401 Unauthorized`	The key is missing, malformed, or revoked.
`403 Forbidden`	The key is valid but lacks permission for this account or resource.

Key safety

Never expose keys in client-side code. All API calls should be made from your backend.
Use test keys everywhere except production. Development, CI, and staging should use wcp_test_ keys.
Rotate compromised keys immediately from the dashboard.