Authentication
Authenticate server-to-server requests with a merchant API key.
Merchant API keys authenticate your backend and select one merchant organization and mode. Ask an owner or administrator to create one in the MB Wallet Merchant Console.
Send the API key
Send the API key as a Bearer credential on every Checkout API request:
Authorization: Bearer mb_test_your_api_key_hereTest keys begin with mb_test_. Live keys begin with mb_live_. Test keys cannot access live data, and live keys cannot access test data.
Create a separate key for each partner integration and environment. This separation lets you revoke one integration without interrupting another.
Keep keys secret
Do not embed API keys in frontend code, logs, source control, screenshots, or support messages.
Store and rotate API keys
The Merchant Console reveals the complete key only when it creates the key. Store it in your server-side secret manager at that time.
API keys expire after 90 days unless the merchant sets another expiration. Replace the key before it expires, then revoke the old key after your integration uses the replacement.
Handle authentication errors
The API returns 401 invalid_api_key for a missing, malformed, expired, unknown, or revoked key. It uses the same response for each case to avoid exposing credential details.