Guide

Authentication

Every request except /health/api carries the client key in the X-Entity-Key header.

We issue the key when you are onboarded. We store only its hash (SHA-256), so a lost key cannot be recovered — only reissued.

Shell

curl https://merchant.dbdlobby.com/products \
  -H "X-Entity-Key: YOUR_ENTITY_KEY"

The API is meant to be called from your server. Never embed the key in browser or mobile code: anyone holding it can spend your balance.

Authorization errors

Code	message	Cause
401	`Missing X-Entity-Key header`	The header is missing or empty.
401	`Invalid X-Entity-Key header`	The value is longer than 128 characters.
403	`Invalid entity key`	No such key.
403	`API access disabled for this client`	API access is disabled for the client. Contact us.

The sandbox (/sandbox/*) accepts the same key — you don't need a separate test key.