Authentication
Learn how to authenticate your API requests securely.
Authentication
The Melon API uses API keys to authenticate requests. You can view and manage your API keys in the Settings > Integrations section of your dashboard.
Providing the API Key
You must include your API key in the Authorization HTTP header for all requests to the Melon API. The key should be passed as a Bearer Token.
Example Request
curl -X GET "https://api.example.com/api/v1/customers" \
-H "Authorization: Bearer mk_test_1234567890abcdef" \
-H "Content-Type: application/json"fetch('https://api.example.com/api/v1/customers', {
headers: {
'Authorization': 'Bearer mk_test_1234567890abcdef',
'Content-Type': 'application/json'
}
})
.then(response => response.json())
.then(data => console.log(data));import requests
url = "https://api.example.com/api/v1/customers"
headers = {
"Authorization": "Bearer mk_test_1234567890abcdef",
"Content-Type": "application/json"
}
response = requests.get(url, headers=headers)
print(response.json())package main
import (
"fmt"
"net/http"
"io/ioutil"
)
func main() {
url := "https://api.example.com/api/v1/customers"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer mk_test_1234567890abcdef")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := ioutil.ReadAll(res.Body)
fmt.Println(string(body))
}<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api.example.com/api/v1/customers");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "GET");
$headers = array();
$headers[] = "Authorization: Bearer mk_test_1234567890abcdef";
$headers[] = "Content-Type: application/json";
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$result = curl_exec($ch);
if (curl_errno($ch)) {
echo 'Error:' . curl_error($ch);
}
curl_close($ch);
echo $result;
?>Security Best Practices
[!CAUTION] Your API keys carry many privileges. Always treat them with the same care as passwords.
- Keep Keys Private: Do not share your API keys in publicly accessible areas such as GitHub, client-side code, or mobile applications.
- Server-Side Only: Make all requests to the Melon API from a secure backend server.
- Key Rotation: If you suspect a key has been compromised, immediately revoke it and generate a new one from your dashboard under Settings > Integrations.
- Use Scopes: When generating API keys, apply the principle of least privilege by selecting only the scopes required for your application (e.g.,
kyc:readorkyc:write).
Unauthorized Requests
If you fail to provide a valid API key, or if the API key provided does not have the necessary scopes to perform an action, the API will return an HTTP 401 Unauthorized or 403 Forbidden response.
{
"status": false,
"error": {
"code": "UNAUTHORIZED",
"message": "Missing or invalid API key"
},
"meta": {
"requestId": "req_123abc456def",
"timestamp": "2024-06-10T14:30:00.000Z"
}
}