Authentication
Every request is signed with HMAC-SHA256 using your API secret.
Generate an API key pair under Dashboard → API & webhooks. The public key identifies you; the secret signs every request and is shown only once.
Headers
| Header | Value |
|---|---|
X-Zyvo-Key | Your public key, e.g. zp_live_… |
X-Zyvo-Signature | Lower-case hex of HMAC-SHA256(raw_request_body, api_secret). For GET requests sign the empty string. |
Content-Type | application/json for POST requests |
Sign the exact bytes you send. If you re-encode the JSON after signing (different spacing or key order), the signature will not match.
Examples
// PHP
$body = json_encode(['amount' => '10.00', 'order_id' => 'INV-1001']);
$signature = hash_hmac('sha256', $body, getenv('ZYVO_SECRET'));
// Node.js
const signature = crypto.createHmac('sha256', process.env.ZYVO_SECRET).update(body).digest('hex');
# Python
signature = hmac.new(secret.encode(), body.encode(), hashlib.sha256).hexdigest()Idempotency
order_id on invoices and reference on withdrawals are idempotency keys: repeating a request with the same value returns the original object instead of creating a duplicate, so retries after a timeout are always safe.