Respawn PayDocs

Authentication

The API uses authentication via X-Client-Id and X-API-Key. For sensitive operations (create transaction and withdrawal), we also recommend sending the operation token.

Required Headers (Base)

Headers
X-Client-Id: fbd6b0c9e4b8331b77700ca6e17972b5
X-API-Key: your-secret-api-key
Content-Type: application/json   (required on POST/PUT)
Accept: application/json         (recommended)

Operation Token (Optional)

To create transactions and request withdrawals, you can generate an additional operation token. This token adds an extra layer of security. It is optional, but if it is sent it must be valid and have the operation scope, otherwise the API returns 401.

Recommended Flow

1

Generate the operation token with your credentials (X-Client-Id and X-API-Key)

2

Send the token in the X-Operation-Token header on create transaction or withdrawal calls

Endpoint to Generate Token

POST/api/v1/operation-auth/token

Alias available: POST /api/Transaction/auth/token

This endpoint only accepts authentication by X-Client-Id and X-API-Key; with any other authentication the API returns 403.

Request Body (Optional)

Body
{
  "scopes": ["transaction:create", "cashout:create"],
  "expiresInSeconds": 300
}
  • • expiresInSeconds: minimum 30, maximum 3600, default 300
  • • scopes: if omitted, uses transaction:create e cashout:create

Response 200

Response
{
  "tokenType": "Bearer",
  "headerName": "X-Operation-Token",
  "expiresInSeconds": 300,
  "scope": ["transaction:create", "cashout:create"],
  "token": "<jwt>"
}

cURL Example

cURL
curl -X POST "https://api.respawnpay.com/api/v1/operation-auth/token" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -H "X-Client-Id: <CLIENT_ID>" \
  -H "X-API-Key: <API_KEY>" \
  -d '{"scopes": ["transaction:create", "cashout:create"], "expiresInSeconds": 300}'

Additional Header (Optional)

Header
X-Operation-Token: <token_gerado>

Accepted on the transaction creation endpoints (POST /api/v1/transactions/create) and withdrawal request (POST /api/Withdraw/request).

Invalid Token Error

401 Unauthorized
{
  "title": "Token de operação inválido.",
  "detail": "Token inválido ou expirado.",
  "header": "X-Operation-Token"
}

How to Get Credentials

Every request needs two values: the Client ID (header X-Client-Id) and your company secret (header X-API-Key). Both come from the company dashboard. Your company must be approved; otherwise every call returns 401.

Step by Step

1

Open the dashboard at https://finance.respawnpay.com/login-company

2

Open the "Credenciais de API" (API Credentials) menu

3

The "API Key (Client ID)" field is your X-Client-Id. It is public and the same for the whole platform (also returned by GET /api/public/client-id)

4

The "Secret Key (Company)" field is your X-API-Key. It is shown in full only when you create or regenerate it ("Regenerar Chaves"); regenerating invalidates the previous key

5

Store your API Key in a safe place (it is shown only once)

Important

The API Key is secret and must be stored securely. Never share it or expose it in client code.

Authenticated Request Example

cURL
curl -X GET "https://api.respawnpay.com/api/Transaction/company/transactions" \
  -H "Accept: application/json" \
  -H "X-Client-Id: fbd6b0c9e4b8331b77700ca6e17972b5" \
  -H "X-API-Key: your-secret-api-key"