Authentication
Your API key
One key, and it is a secret. It starts with brykto_live_sk_ and lives under Dashboard > Developer Tools.
The checkout.js embed needs no key at all. It identifies a button by its bky_btn_... ID, and everything about the payment is read server-side.
The secret key creates payments as you
Never put it in browser code, a public repository, a screenshot, or a log line. Anyone holding it can create payments in your name. Rotate immediately if it leaks.
Store it in an environment variable rather than in source:
BRYKTO_API_KEY=brykto_live_sk_your_key_hereMaking a request
The secret key goes in the X-API-Key header. Not in the URL, and not as a bearer token.
POST /v1/payment-links HTTP/1.1
Host: bryktopay.com
X-API-Key: brykto_live_sk_your_key_here
Content-Type: application/jsonBase URL
https://bryktopay.comAll API endpoints live under /v1.
Rotating your key
- Open Dashboard > Developer Tools.
- Rotate the key.
- Update whatever was using it.
The old key dies the instant you rotate
There is no grace period and no overlap window. Have the replacement ready to deploy before you press the button.
Checkout buttons already on your website are unaffected. They carry no key.
Errors
Every error returns JSON with a detail field.
{
"detail": "Invalid API key."
}| Code | Meaning | What to do |
|---|---|---|
201 |
Created | Nothing, this is success |
401 |
Missing or invalid key | Check the header name and the key value |
402 |
Free plan monthly cap reached | Upgrade, or wait for the 1st |
403 |
Onboarding not complete | Finish onboarding on the account |
422 |
Validation error | Read detail, it names the field |
429 |
Rate limited | Back off and retry |
503 |
Payments paused platform-wide | Retry later, nothing is wrong with your call |
Next steps
- Quickstart - a working payment in about ten minutes
- Payment Links API - the full request and response reference