VastelBusinessDocs
Get API keys

Start

Authentication

Every request needs API keys plus an HMAC request signature. Sandbox keys and live keys are separate pairs.

Open Dashboard → API access and unlock with your security PIN. You get a live pair (vst_pub_ and vst_sec_) and a sandbox pair (vst_test_pub_ and vst_test_sec_). There is no separate sandbox host. The key decides the mode.

A sandbox response always includes sandbox: true, mode: "sandbox", and test_data: true next to success. A live response omits those fields. Keep both secrets on your server.

Optional: set an API IP allowlist under Dashboard → API access. When configured, only those IPs can call the Merchant API with your keys.

X-Signature and X-Timestamp are required on every request. The signature is HMAC-SHA256 of the exact raw body plus the timestamp, using the secret key for that mode. Use an empty string as the body for GET. Expired timestamps are rejected.

Headers

  • X-Public-Key

    string · required

    Live vst_pub_… or sandbox vst_test_pub_….

  • X-Secret-Key

    string · required

    The matching secret, vst_sec_… or vst_test_sec_…. Server-side only.

  • Content-Type

    string · required

    application/json on requests with a body.

  • X-Timestamp

    string · required

    Unix seconds.

  • X-Signature

    string · required

    HMAC-SHA256 hex of rawBody + timestamp.

GET /api/v1/rates HTTP/1.1
Host: api.vastel.io
X-Public-Key: vst_pub_xxxxxxxx
X-Secret-Key: vst_sec_xxxxxxxx
X-Timestamp: 1730582400
X-Signature: <hmac hex>
PreviousOverviewNext Quick start