StablesPay Developers

Pilot API

Use a scoped API application and channel. Read allowed assets, create hosted payment requests, and look up their original merchant references. Configure and verify a webhook receiver for payment and expiry events. Accounting exports have their own workspace access flow.

Create with a unique merchantOrderId, fiatAmount as a decimal string, fiatCurrency AUD, and an allowed chainId and stablecoin. The credential fixes the application and channel. Test credentials cannot authorize production-network requests.

Signing and original-request recovery

Keep the API key and signing secret on your server. API requests use HMAC-SHA256 over five dot-separated fields, in this order:

1. Timestamp in Unix seconds
2. Receive window in milliseconds, default 300000 and maximum 600000
3. Uppercase HTTP method
4. Exact encoded path and query string
5. Exact body string, empty for GET

Send the key, timestamp, receive window and v1-prefixed hexadecimal signature in the corresponding x-stablespay headers. The authenticated Integration guide contains the exact header names and signature example.

If a response is lost, look up the original merchantOrderId or retry with exactly the same fields. A changed request conflicts. Concurrent identical submissions recover the same order. An order record does not confirm receipt of payment.

Receiver verification and event delivery

Webhook signing uses a separate one-time secret and signs the timestamp, a dot and the exact body. Verify the signature before parsing; echo the signed challenge to verify the current endpoint configuration. Redirects are not accepted as verification.

Deduplicate by original eventId and durably accept the event before acknowledging it. Automatic retries are bounded. When the outcome is unknown, inspect receiver logs before explicitly replaying the original event. A successful HTTP response does not prove business processing.

Sign in, choose your company, then open Developers → Integration guide to inspect current application, credential, verification and delivery evidence.

Production credentials

Production API keys require approval, workspace verification, scoped permissions, and environment boundary checks. Public or preview URLs must not be used as production WebAuthn or payment endpoints.

Integration boundary

API integrations must preserve the non-custodial model. StablesPay provides payment request and ledger infrastructure; it does not custody assets or act as an exchange, lender, or fiat clearing institution.