Quickstart

1. Create an API keyCopy Anchor Link

In the sandbox merchant dashboard, open Settings → API keys and create a key. Keys start with upk_.

2. Make a requestCopy Anchor Link

Send X-API-KEY, X-Timestamp, X-Nonce, and X-Signature with every request. The key identifies the merchant; requests never include a merchant ID. Use the API secret only for local signing; never send it.

export UPP_BASE_URL="<sandbox origin>"
export UPP_API_KEY="upk_..."
export UPP_API_SECRET="ups_..."

target='/api/v1/card-products'
timestamp=$(date +%s)
nonce=$(openssl rand -hex 16)
body_hash=$(printf '' | openssl dgst -sha256 -r | cut -d ' ' -f1)
signature=$(printf 'GET\n%s\n%s\n%s\n%s' "$target" "$timestamp" "$nonce" "$body_hash" | openssl dgst -sha256 -hmac "$UPP_API_SECRET" -r | cut -d ' ' -f1)

curl "$UPP_BASE_URL$target" \
  -H "X-API-KEY: $UPP_API_KEY" \
  -H "X-Timestamp: $timestamp" \
  -H "X-Nonce: $nonce" \
  -H "X-Signature: $signature"

Sign the uppercase HTTP method, exact path including the original query string, timestamp, nonce, and body digest (lowercase SHA-256 hex), joined with newlines and no trailing newline. The signature is HMAC-SHA256 hex in either letter case. Timestamps must be within 300 seconds of server time, inclusive; use a fresh nonce on each request and retry.

For JSON and other requests, the digest is the SHA-256 of the exact body bytes sent. For multipart/form-data uploads, it is not taken over the raw bytes: write one line name:SHA-256(part content) per field (file bytes for files), sort the lines in byte order, join them with newlines and hash the result with SHA-256. See Authentication in the API reference.

Invalid keys or signatures, missing signing headers, invalid timestamps and replayed requests return 401 unauthenticated. Reissue older credentials without an API secret.

3. Try it in the docsCopy Anchor Link

Every page in the API reference has a Try it panel that sends the request to the sandbox:

1. Open an endpoint, for example Create customer.
2. Enter your sandbox key in X-API-KEY and fill in the request parameters.
3. Sign the exact method, path and body locally, then enter X-Timestamp, X-Nonce, and X-Signature before sending. The panel does not sign automatically; refresh these values for each request. Never enter the API secret.

Next stepsCopy Anchor Link

• Configure a webhook endpoint under Settings → Webhook endpoints and verify signatures.
• Handle errors by code, not by message: see Errors and limits.