Authentication

Use Authorization: Bearer <api_key_jwt> as the standard authentication method for Beyounger merchant APIs.

API Keys And Access

API Keys are managed in the Merchant Portal.

Current merchant-side capability includes:

1. create API Keys
2. update API Key settings
3. create additional API Keys for different systems or environments
4. delete API Keys that are no longer needed

If no expiration time is configured when an API Key is created, the key expires after 30 days by default. Configure an explicit expiration time for long-running production integrations, and rotate keys before they expire.

Recommended practice:

1. create separate API Keys for production services, staging tools, and internal operations
2. rotate API Keys through the Merchant Portal when access control changes
3. avoid sharing one API Key across unrelated services

Standard Request Header

Authorization: Bearer <api_key_jwt>
Content-Type: application/json
Accept: application/json

Base URL

Use the production API domain:

https://app.beyounger.com

First Validation Request

Use one of the following endpoints to confirm your credential is valid and mapped to the expected merchant account:

1. GET /payment/account
2. GET /payment/accounts

Example:

curl -X GET "https://app.beyounger.com/payment/account" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <api_key_jwt>"

Compatibility Note

The backend may accept compatible authentication header forms in some cases, but documentation standardizes on Bearer authentication only.

Merchant integrations should use:

Authorization: Bearer <api_key_jwt>

Operational Guidance

Before going live, confirm:

1. the API Key belongs to the correct merchant account
2. the API Key has access to the products your team is integrating
3. the API Key expiration time is explicit; if it was left unset, it defaults to 30 days
4. your production service stores the API Key in a secure secret manager
5. your team has a clear key rotation process in the Merchant Portal