Stax Authentication

generated: '2026-08-29'
method: searched
source: https://docs.staxpayments.com/reference/overview
docs:
- https://docs.staxpayments.com/reference/overview
- https://docs.staxpayments.com/reference/merchant-api-keys
- https://docs.staxpayments.com/reference/partner-api-keys
- https://docs.staxpayments.com/docs/accessing-and-creating-api-keys
- https://docs.staxpayments.com/reference/ephemeral-authentication-tokens-1
summary:
  types:
  - http
  oauth2: false
  openid_connect: false
  mutual_tls: false
  note: Bearer API key only. No OAuth 2.0, no OIDC, no scope surface — scopes/ is intentionally not emitted.
transport:
  header: Authorization
  format: Bearer <API key>
  content_type: application/json
  tls: TLS 1.2 or 1.3 required; SSLv2/v3 and TLS 1.0/1.1 are blocked at the network level. Certificate and cipher pinning
    are explicitly discouraged.
schemes:
- name: ApiKeyAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  level: merchant
  description: Merchant-level API key. Direct access to Stax Pay for payment processing, invoicing and transaction management;
    scoped to a single merchant account and cannot reach partner-level functionality.
  sources:
  - openapi/stax-api-openapi.json
  - https://docs.staxpayments.com/reference/merchant-api-keys
- name: PartnerApiKey
  type: http
  scheme: bearer
  level: partner
  description: Partner-level API key for ISVs and platforms managing many merchants through one integration — merchant creation,
    enrollment, registration data, per-merchant key issuance and partner-brand webhooks.
  operations_declaring_it: 17
  sources:
  - openapi/stax-api-openapi.json
  - https://docs.staxpayments.com/reference/partner-api-keys
- name: EphemeralAuth
  type: http
  scheme: bearer
  level: ephemeral
  description: Short-lived token minted from an API key by GET /ephemeral. Expires in 24 hours and is used for single sign-on
    into Stax from a partner surface.
  operations_declaring_it: 2
  sources:
  - openapi/stax-api-openapi.json
  - https://docs.staxpayments.com/reference/ephemeral-authentication-tokens-1
sandbox_vs_live: Same base URL and same header for both. A sandbox key is bound to a test gateway; a live key processes real
  money. There is no key PREFIX documented that lets an integrator tell a test key from a live key by inspection — the only
  published signal is which account issued it.
client_side:
  library: Stax.js
  credential: Web Payments token (public key)
  note: Browser tokenization uses a separate public Web Payments token, never the secret API key.