The provider API

What a provider key can do through the API, and where to read the details.

Two keys, two scopes

Every request carries a key in the X-Api-Key header. Your provider key acts for every merchant under your provider, and it is the key for your own integration. A merchant key is scoped to one merchant and cannot create merchants or issue keys. Keys are shown once, so store them on your server and never in browser or mobile code.

Sandbox keys start with pmw_test_ and production keys with pmw_live_. Each response carries an X-PayMidWare-Environment header telling you which deployment answered.

What is provider-only

• Creating and listing merchant accounts.
• Setting, listing and removing a merchant's gateway credentials.
• Issuing and revoking a merchant's own API key.
• Listing the gateways open for new setups, and managing the integration connections.

Everything else (payments, customers, invoices, scheduled payments, products and tax, locations, documents and short links) works with either kind of key, with the merchant named in the address or in an X-Merchant-Reference header.

Where to read more

• The developer guide covers authentication, tokenization, ACH, customers, invoicing, schedules, e-signature, short links, integrations and webhooks.
• The interactive reference, with a Providers section listing exactly what a provider key can call, is on the API server at /swagger, and is linked from the top of the developer guide.