Skip to main content
Send your API key in the X-API-Key header on every request.

​
Get a key

Keys are created in the Moove Dashboard at moove.xyz/dashboard/api-keys.
The plaintext key is shown once, at creation. It is not stored and cannot be shown again. Copy it into your secret manager immediately.
There is no endpoint that mints a key. Key management is session-authenticated only — a key can never issue another key, so a compromised key cannot escalate itself. Moove API Keys →

​
Scopes

A key is issued with explicit scopes. A request is rejected with 403 if the key lacks the scope its operation requires. You do not select raw scopes. You select an agent, which expands to the scopes it needs.

​
A key is a down-scope of its owner

A key acts as the user who issued it and can only do a subset of what they can do.No endpoint moves funds. Payment links always settle to the key owner’s own default wallet, and the caller cannot specify a destination — so a leaked key can create requests that pay its owner, and nothing else.

​
Handling keys

  • Store keys in a secret manager or environment variable. Never in source control.
  • Never paste a key into a prompt, chat, issue or screenshot.
  • Use one key per service, so revoking one does not take down the rest.
  • Revoke any key you are unsure about and issue a new one.

​
Revocation

Revoking a key stops it working immediately.
Revocation is permanent. There is no un-revoke. The plaintext was never stored, so a revoked key could not be used again even if the record were restored.

​
Failure modes

Errors →

​
Next

Moove Payment Links

Make your first call.

Errors

Every status code.

Rate Limits

Per key and per IP.