Error codes
Every error response has error.code, message and hint, in the language of your Accept-Language header. Full spec: /openapi.json · /llms.txt · /docs
KEY_DISABLED HTTP 403
The API key is paused, or the merchant account is suspended.
DOMAIN_NOT_VERIFIED HTTP 403
Live keys created in the portal must verify their website domain first (upload the verification .html file or add the DNS TXT record). One key = one domain.
BAD_SIGNATURE HTTP 401
This key requires signed requests and the signature is missing, older than 5 minutes or wrong. Sign `<timestamp>.<METHOD>.<path+query>.<sha256 hex of body>` with HMAC-SHA256 using the signing secret.
INVALID_CODE HTTP 400
Sign-in code is invalid, expired (2 minutes) or already used. Start the sign-in again.
KEY_EXPIRED HTTP 403
The API key passed its expiry date. Renew it in the merchant portal; the key string stays the same.
IP_NOT_ALLOWED HTTP 403
The caller IP is not in the key's IP whitelist.
WRONG_PRODUCT HTTP 403
The key belongs to another product (e.g. a slip_verify key used on /v1/deposits/slip).
RATE_LIMITED HTTP 429
Too many requests for this key. Wait the number of seconds in the `Retry-After` header.
VALIDATION_ERROR HTTP 400
The request body is malformed. `message` says which field.
INSUFFICIENT_CREDITS HTTP 402
Not enough credits. Nothing was charged and no provider was called. Top up and retry.
NOT_FOUND HTTP 404
Unknown route or resource.
BODY_TOO_LARGE HTTP 413
Request body exceeds 64 KB.
KYC_REQUIRED HTTP 403
Crypto only: identity verification must be approved before the first withdrawal.
INSUFFICIENT_BALANCE HTTP 402
Crypto only: the asset balance is too low. Nothing was deducted.
INTERNAL_ERROR HTTP 500
Unexpected server error. Report the `request_id`.