API Documentation

Base URL https://api.acme.dev — all requests require TLS 1.2+ and a bearer token.

Authentication

Server-to-server calls use a secret API key in the Authorization header. Browser clients exchange a client ID + PKCE flow for a short-lived auth token.

Authorization: Bearer sk_live_...
Acme-Version: 2026-06-01

POST

/v1/payments

Create a payment

Creates a payment intent and returns a client token for confirmation.

curl -X POST https://api.acme.dev/v1/payments \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 4500, "currency": "usd", "capture": true }'

GET

/v1/payments

List payments

Returns a paginated list of payments for the authenticated application.

curl https://api.acme.dev/v1/payments?limit=50 \
  -H "Authorization: Bearer $API_KEY"

POST

/your-endpoint

Verify a webhook signature

Compute an HMAC-SHA256 over the raw body and compare it to the signature header.

const expected = createHmac("sha256", process.env.WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
if (expected !== req.headers["x-acme-signature"]) return res.status(401).end();

DELETE

/v1/keys/{id}

Revoke an API key

Immediately invalidates a key. In-flight requests fail with 401.

curl -X DELETE https://api.acme.dev/v1/keys/key_a4 \
  -H "Authorization: Bearer $ADMIN_KEY"

Error codes

400invalid_request — a parameter is missing or malformed

401unauthorized — key revoked, expired or missing

403insufficient_scope — the credential lacks the required permission

409idempotency_conflict — same key, different payload

429rate_limited — retry after the Retry-After header

500server_error — safe to retry with the same idempotency key