Authentication
Merchant servers authenticate to the Pay API with an API key.
X-Api-Key: <secret>
X-Api-Version: 1
Set the key in the API reference Try Request panel when you test from this site. Requests are proxied through proxy.docs.amos.com and only allowed to *.amos.com.
Rules
- Sandbox keys only against
https://api-sandbox.amos.com. Production keys only againsthttps://api.amos.com. - Never put
X-Api-Keyin a frontend bundle, mobile binary, or git repo. - Rotate keys from the dashboard if one leaks.
- Do not send
X-Account-Id. Account scope comes from the key.
Two tokens (checkout)
| Token | Who holds it | Purpose |
|---|---|---|
| Render token | Browser | Mounts the iframe (?token=). Encodes origins, methods, env. |
| Embed token | Server → browser, one confirm | Authorization: Embed … inside the iframe. From POST /payment_intents or POST /setup_intents. Short ttl (typically 3600s). |
Render token loads the form. Embed token authorizes one confirm. See Embedded checkout.
Status codes
401 Unauthorized— key missing or inactive.403 Forbidden— key cannot access that resource.429 Too Many Requests— retry with exponential backoff.