Authentication

Every Merchant API call uses an API key and a request signature.

API keys

Authorization: Bearer orq_mk_test_...

Prefix	Mode
`orq_mk_test_`	Test payments
`orq_mk_live_`	Live payments (after go-live approval)

With an API key you can create and get payments, and call whoami.

Webhook setup, API key management, and go-live live in the dashboard — not on the API key surface.

Request signing

Every API-key request must include:

X-Request-Signature: t=<unix_seconds>,v1=<hex>

Your signing secret (orq_ms_…) is issued in the dashboard under API keys.

Sign this string (UTF-8), then HMAC-SHA256 → hex:

{unix_seconds}.{METHOD}.{pathname}{?query}.{rawBody}

Practical rules:

GET / HEAD use an empty body
Sign the exact JSON bytes you send (compact JSON is easiest)
Timestamp must be within about 5 minutes of Orqpay’s clock

Interactive helper:

Request signature generator

Builds X-Request-Signature and a ready curl for Merchant API key calls (Authorization: Bearer + signature). JSON bodies are signed as compact bytes — send that exact body. Dashboard session calls do not need a signature. Secrets stay in your browser.

API base URL

API key (for curl only)

API signing secret

Method

Path (+ query)

Add Idempotency-Key on POST / PUT / PATCH

Full page: Request signer.

Whoami

Confirm the key works:

curl https://api.orqpay.com/v1/whoami \
  -H "Authorization: Bearer orq_mk_test_..." \
  -H "X-Request-Signature: t=...,v1=..."

Idempotency

Send Idempotency-Key on POST /v1/payments.

Same key + same body → same payment
Same key + different body → IDEMPOTENCY_CONFLICT

Rate limits

100 requests per minute per API key. Over the limit → 429 / RATE_LIMITED.