Get started
Authentication
Every call carries an API key in a header.
Every endpoint except the OpenAPI spec needs a key. Send it one of two ways:
curl -H "Authorization: Bearer pd_YOUR_KEY" https://payday.direct/api/v1/stats
curl -H "X-API-Key: pd_YOUR_KEY" https://payday.direct/api/v1/statsKeeping a key safe
- Call the API from your server or bot. Anything a browser loads, its user can read.
- Payday keeps only a SHA-256 fingerprint of each key, so nobody at Payday can read it back. It is shown to you once.
- Revoke a key the moment it may have leaked, from API keys when signed in, or from anywhere by sending the key itself:
curl -X DELETE -H "Authorization: Bearer pd_YOUR_KEY" https://payday.direct/api/v1/keys/selfA revoked key stops working everywhere within 15 seconds.
Two kinds of key
| Read key | Launch key | |
|---|---|---|
| Sign-in | None | Signed in with X |
| Reads data | Yes | Yes |
| Launches coins | No | Yes, when made with launching switched on |
| How many | 3 new a day per address | 5 active, 10 new a day per account |
| Shared allowance | All keys from one address share 1,200 requests a minute | 600 a minute each |
| Expires | After 90 days unused | No |
| Listed on API keys | No, keep it safe | Yes, with usage and Revoke |
Launching cannot be switched on later. Make a new key instead.