Authentication

Every request uses HTTP Basic authentication: your client_id is the username and your api_key is the password. Keys are created in the dashboard under API keys; the API key is shown only once.

Sending your keys

curlbash

curl https://api.armhed.lat/balance -u "$CLIENT_ID:$API_KEY"

Node.jsjavascript

const auth = "Basic " + Buffer.from(`${process.env.CLIENT_ID}:${process.env.API_KEY}`).toString("base64")

const res = await fetch("https://api.armhed.lat/balance", { headers: { Authorization: auth } })
const balance = await res.json()

Call the API only from your server. Never ship the API key to a browser or mobile app.
If you enabled an IP allowlist in the dashboard, calls from other addresses get 403 forbidden.
Sandbox keys start with sbx_ and only work on the sandbox base URL.
A missing or wrong key returns 401.

Operation tokens (optional)

For an extra factor on money-moving calls, issue a short-lived token and send it in the Armhed-Operation-Token header of POST /charges or POST /payouts. Calls without the header keep working; a header with an invalid, expired or wrong-scope token is rejected with 401.

POST/tokens

scopesstring[]

charges:create and/or payouts:create. Default: both

expires_ininteger

Lifetime in seconds, 30 to 3600. Default 300

Issue and use a tokenbash

TOKEN=$(curl -s https://api.armhed.lat/tokens -u "$CLIENT_ID:$API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "scopes": ["payouts:create"], "expires_in": 120 }' | jq -r .token)

curl https://api.armhed.lat/payouts -u "$CLIENT_ID:$API_KEY" \
  -H "Armhed-Operation-Token: $TOKEN" \
  -H "Idempotency-Key: payout-77" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 2500, "pix_key": { "type": "email", "key": "ana@example.com" } }'

201 Createdjson

{
  "object": "token",
  "token": "eyJhbGciOiJIUzI1NiIs...",
  "scopes": ["payouts:create"],
  "expires_at": "2026-10-31T12:02:00Z"
}