Authentication
Every API call carries a secret sw_live_ key, created in Settings › Integrations and shown only once. 120 requests per minute per key.
Create a key
- Open Settings › Integrations in your StampyWallet account (the owner or a manager).
- Create a key and give it a name that says where it is used ("Counter POS", "Website").
- Copy it right away. It starts with
sw_live_and is shown in full only once: StampyWallet only keeps a fingerprint of it. If lost, it cannot be recovered: revoke it and create another one.
Send it with every call
The key goes in the Authorization header, after the word Bearer:
Authorization: Bearer sw_live_4f9c2a7e1b...A key gives access to one business: the one it was created in. If you manage several locations, create a key in each one.
Warning : the key acts on your behalf: it creates customers and adds visits. Keep it on the server side (environment variable, secrets vault), never in the code of a web page or a mobile app, never in a Git repository.
Revoke a key
In Settings › Integrations, revoke the key: calls carrying it fail immediately with 401 and the code cle_revoquee. Do it as soon as a key may have leaked, or when a provider no longer needs it.
Access errors
| Status | code | When |
|---|---|---|
401 | non_authentifie | Missing header or unknown key |
401 | cle_revoquee | The key has been revoked |
403 | formule_requise | The business is not on the Growth plan (the API is included in it, and open during the trial) |
403 | interdit | The action is not allowed for this business |
429 | trop_de_requetes | More than 120 requests per minute with this key |
Rate limit
120 requests per minute per key. Beyond that, the response is 429 with the header Retry-After: 60: wait that number of seconds before trying again. An ordinary POS is very far from it.
The error format in detail is on the Errors page.
Updated