The merchant-token header
Send your API credential in a merchant-token header on every request. It is issued per environment: your sandbox token will not work against production and vice versa. Treat it as a server-side secret: it must never be embedded in a browser bundle, mobile app or repository.
- Header name: merchant-token
- Sandbox and production tokens are separate values.
- Rotate through configuration; no code change should be needed.
merchant_id and merchant_site_id
The token authenticates you; the identifiers say which account and which site the traffic belongs to. Both are sent in the JSON body of the create call. If you run several brands or storefronts, each gets its own merchant_site_id so routing, reporting and settlement stay separated.
Idempotency on create calls
Create endpoints require a unique Idempotency-Key header. Generate one UUID per logical payment attempt and reuse the same value on any retry, so a network timeout followed by a retry resolves to the original payment instead of charging the consumer twice.
- One key per payment attempt, not per HTTP request.
- Keep the key alongside your order record so retries can find it.
- Pair it with a stable request_id for reconciliation.
Where this appears in the snippets
The cURL, Node and PHP samples on the Developer Zone all show the same three pieces: the merchant-token header, the Idempotency-Key header, and merchant_id plus merchant_site_id in the body. Copy one and swap in your own credentials.
merchant-token: $SLIKAIR_MERCHANT_TOKEN
Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
Content-Type: application/jsonWhen authentication fails
A missing or wrong token returns status 502 (Unauthorized). Missing merchant_id or merchant_site_id returns 510 (Missing params). Both are listed in the status code reference on the Developer Zone.