Skip to main content
One credential authenticates the whole API. It applies to every endpoint under /api/v0/** — wallets, quotes, recipients, accounts, transactions, reference data, onboarding, POBO and webhooks alike. There is no separate webhook credential. Every request carries two required headers.
These are two different things. API-KEY is your credential; Api-Version pins behaviour. Omitting the version is a 400, whatever the key says.
Your API key is a secret. Keep it server-side, never ship it in browser or mobile code, and never commit it to source control. If it leaks, ask Endl to issue a replacement credential.

​
Permissions

Each key carries permissions that gate which endpoints it can reach. A valid key that lacks the required permission is rejected with 403, raised at the edge before the request reaches the service — so it never confirms or denies that the resource you asked for exists.

​
Failure modes

Authentication fails closed, and deliberately does not tell you which part was wrong.
​
Your credentials were rejected
The header is missing or blank, the key is unknown, or the partner is inactive. These are indistinguishable by design. Retrying will not help — fix the configuration.
​
Valid key, missing permission
The credential authenticated but does not carry the permission this endpoint requires. Raised at the edge, so no resource id is confirmed or denied.
​
Rate limit exceeded
Too many requests for this key. Carries X-RateLimit-Limit and X-RateLimit-Remaining. Nothing was processed — back off and retry.
​
Endl could not reach the service
You authenticated successfully but the service behind the edge was unreachable. Retry with backoff.
​
Endl could not verify right now
Endl could not reach the credential store. Your key may be perfectly valid, so retry with backoff. This is deliberately not a 401.
Authentication runs before routing. Without a valid key every request answers 401, including one to a path that does not exist or with the wrong verb. A 404 or 405 only becomes visible once you are authenticated.
Treat 401 and 403 as configuration problems to fix, and 429, 502 and 503 as transient faults to retry. Retrying a 401 will never succeed.

​
Verifying webhooks is a separate thing

Authenticating your outbound calls uses the headers above. Verifying an inbound webhook delivery is the reverse direction and uses a different mechanism — an HMAC-SHA512 signature Endl sends on the request. See Verifying signatures.