Which credential goes where?
Use your merchant API key in thex-api-key header on your server. For the embedded cashier, your server issues a short-lived access grant bound to the cashier instance. Player operations use that grant. Check the operation’s security section before choosing a header.
Your webhook endpoint receives incoming events and verifies them using its webhook signing secret. The event catalogue includes events beyond the HTTP receiver examples in OpenAPI. See webhook events.
Read the result
A successful create request can still return a business rejection or a transaction that is waiting for the provider. Inspect the body, save the transaction ID and keep the original idempotency key with your order. Amounts are decimal strings in major units, for example"12.30" for EUR. Errors and retries · Idempotency and amounts