The Ivy API uses API Keys to authenticate requests. You can view and manage your API Key in the Ivy Dashboard.
X-Ivy-Api-Key
header.
All API requests must be made over HTTPS. Calls made over plain HTTP will fail. API requests without authentication will also fail. Ivy returns an authentication error 401
if the key is incorrect or outdated.
You can use the Ivy Dashboard to rotate your API Key. If you’re setting up Ivy through a Third-Party Platform (3PP), copy and paste your API Key in live mode to begin processing payments.
Type | Base URL | When to Use | How to Use |
---|---|---|---|
Sandbox | https://api.sand.getivy.de | Use this mode as you build your app. In Sandbox Mode, payments will not be processed. | Integrate Ivy as you would in Production Mode. You will automatically be redirected to test payment flows. |
Production | https://api.getivy.de | Use this mode when you’re ready to launch the checkout. In Production Mode, payments will be processed. | Use valid bank accounts. Use actual payment authorizations and payment flows. |
X-Ivy-Signature
header. Verify this value to ensure the request is coming from Ivy and not from a third party.
To validate incoming requests:
Webhook Signing Secret
from the Ivy DashboardX-Ivy-Signature
Header against a newly calculated Signature for every incoming requestWebhook Signing Secret
with HMAC & SHA-256 Hash