Authentication
Client ID and client secret in the headers of every request.
Every API call carries the credentials generated under Developers in the dashboard. There is no session token or login step: each request is authenticated on its own, always over HTTPS.
Accepted formats
Use one of the three formats (they are equivalent):
vspi: weetpay-100123
vsps: 3f1c9a52-7b0e-4d61-9a8c-2e5f4b7d1a90Same names as the compatible gateway API: migrating requires no code changes, only the URL and keys.
Examples
curl https://api.weetpay.com/api/v1/gateway/walletBalance \
-H "vspi: $WEETPAY_CLIENT_ID" \
-H "vsps: $WEETPAY_CLIENT_SECRET"Authentication responses
Messages are returned in Portuguese.
| HTTP | message | code | What to do |
|---|---|---|---|
401 | Credenciais ausentes | — | send the client ID and client secret |
401 | Credenciais inválidas | — | check your keys; the secret may have been updated in the dashboard |
403 | Verificação de identidade pendente | KYC_REQUIRED | complete identity verification |
403 | Conta bloqueada. Fale com o suporte. | ACCOUNT_BLOCKED | contact support |
429 | Limite de requisições por minuto atingido | RATE_LIMITED | wait and retry (limits) |
429 | Muitas tentativas com credenciais inválidas. Tente mais tarde. | RATE_LIMITED | the IP sent too many wrong credentials; fix them and wait a few minutes |
Best practices
The client secret gives access to your balance. Never put it in a mobile app, website (browser JavaScript) or repository. Call the API from your server only.
- Keep the keys in environment variables or a secrets vault.
- If you suspect a leak, use Update credentials under Developers: the old secret stops working immediately (the client ID stays the same).
- Keep API payouts disabled if you only receive payments — even with leaked keys, nobody can withdraw money.
- The client secret also signs your transaction callbacks: updating it changes the validation key (Callbacks).