احراز هویت — crptoX API

احراز هویت Bearer

API Secret خود را در هدر Authorization تمام درخواست‌های API قرار دهید.

Authorization TEXT

Authorization: Bearer YOUR_API_SECRET

نمونه BASH

curl https://crptox.com/api/v1/invoices/INVOICE_UUID \
  -H "Authorization: Bearer YOUR_API_SECRET" \
  -H "Accept: application/json"

API Key Environments

Sandbox and Live credentials are separate. The prefix of the API key identifies the environment in which the request will be processed.


                            crx_test_...

Sandbox

Used for Sandbox requests and supported blockchain test networks.


                            crx_live_...

Live

Used for production requests and supported blockchain main networks.

Sandbox and Live Isolation

Sandbox and Live data are isolated. Invoices, wallets, blockchain transactions, and other payment data created in one environment are not available to the other.

The environment cannot be selected or overridden in the request body. crptoX always derives it from the authenticated API key.

Request Body JSON

{
  "network": "bsc",
  "asset": "usdt",
  "amount": "10.000000"
}

For example, the same network value can refer to a test network when authenticated with a crx_test_ key and its production network when authenticated with a crx_live_ key.

Sandbox Networks

Sandbox lets you run the complete payment lifecycle using supported test networks and test tokens.

TRON

Shasta

TRON Sandbox transactions are processed on the Shasta test network.

BSC

BSC Testnet

BSC Sandbox transactions are processed on BSC Testnet.

Sandbox tokens have no real monetary value. Make sure the wallet you configure belongs to the same test network you intend to use.

API Key Lifecycle

Treat API secrets as sensitive credentials throughout their lifecycle.

Store API secrets securely on your server and never expose them in browser-side code or public repositories.
Use Sandbox keys during development and testing, and Live keys only in production.
Revoke or replace a key immediately if you believe it has been exposed.
Use separate API keys for separate applications or integrations when operational isolation is useful.

اطلاعات احراز هویت نامعتبر

درخواست‌هایی که اطلاعات احراز هویت معتبر نداشته باشند، پاسخ HTTP 401 دریافت می‌کنند.

HTTP 401 JSON

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API credentials."
  }
}

از API Secret خود محافظت کنید

API Secret را هرگز در JavaScript سمت مرورگر قرار ندهید.
API Secret را هرگز در Source Control ذخیره نکنید.
Secretها را در متغیرهای محیطی یا Secret Manager امن نگهداری کنید.
برای ارتباط با API از HTTPS استفاده کنید.
Rotate credentials when team access changes or whenever credential exposure is suspected.

محدودیت درخواست

محدودیت فعلی API برابر با ۶۰ درخواست در هر ۶۰ ثانیه برای هر پذیرنده است.

در صورت عبور از این محدودیت، API پاسخ HTTP 429 به همراه هدر Retry-After برمی‌گرداند.

HTTP 429 JSON

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded."
  }
}