Authentication and permissions
Headers
Section titled “Headers”| Base URL | https://api.auryon369.com.br |
| Format | JSON, UTF-8. HTTPS only. |
| Authentication | x-public-key and x-secret-key headers on every request |
curl https://api.auryon369.com.br/v1/me \ -H "x-public-key: $AURYON_PUBLIC_KEY" \ -H "x-secret-key: $AURYON_SECRET_KEY"A missing, wrong, revoked or expired credential returns 401 with the same message in all four
cases: the response does not help anyone guessing a key.
Permissions
Section titled “Permissions”Each credential has only the permissions you select. Give each system the minimum it needs.
| Permission | What it allows |
|---|---|
PRODUCER_DATA |
account data and balance |
PRODUCER_TRANSACTIONS |
query sales and subscriptions; in the legacy API, also create charges (PIX, boleto, BDM) and request refunds |
PRODUCER_WITHDRAWS |
query withdrawals (the most sensitive one) |
PRODUCER_CHECKOUT |
create products, offers and checkout links (legacy API, POST /api/v1/gateway/checkout) |
Without the route’s permission the response is 403, and the message says which one is missing.
A credential only sees its own account. No route accepts another producer’s ID, and a resource
from another account returns 404, just like a resource that does not exist.