Authentication

Every call is server to server with a secret key in the Authorization header. There are no cookies and no CORS: a request a browser marks as cross-site is refused.

Authorization: Bearer set_live_<40 characters>

Key types

• A key is shown once, when SET issues it. SET stores only its SHA-256 and its first 12 characters, to tell keys apart.
• A key belongs to one platform, merchant or partner. Several keys may be live at once so a key can be rotated and the old one revoked.
• Keep keys in a secret manager. Never put a key in a browser, a mobile app, a repository, a ticket or a chat.

Scopes

API keys carry read (every GET) and/or write (every POST). A call outside the key's scopes answers 403 scope_missing. GET /v1/webhook_secret needs write because it reveals a secret.

Check a key

GET /v1/ping
→ { "platform": "ptr_example", "name": "Example Payments AG", "kind": "platform", "key": "set_live_a1B2", "scopes": ["read", "write"], "livemode": true }

kind is platform (SET API) or merchant (SET Merchant API).

Rate limits

Each key is limited per minute, with a tighter limit on writes. Over the limit: 429 rate_limited. Wait a minute and retry with backoff. Polling GET /v1/events once every few seconds is well within limits; webhooks are better.

Getting a key

Keys are issued by SET after the business passes SET's KYB and signs SET's terms. Sandbox keys are issued first. Ask through https://simpleeasytransactions.com/contact?service=set-api.

Revocation

SET revokes a key at the holder's request, on suspected compromise, or when the compliance programme requires it (for example a sanctions match or an unanswered request for information). A revoked key answers 401 api_key_invalid.