Authentication
Every request to /v1 needs an API key. Create one under Developers → API keys in the dashboard; keys belong to one account, your personal one or an organization, and act on its behalf. Send it as a bearer token. Keys are shown once, so store them somewhere safe and revoke them from the dashboard if they leak.
curl https://api.velirapay.com/v1/charges \ -H "Authorization: Bearer vp_live_…" \ -H "Accept: application/json"
A missing, revoked or unknown key answers with 401 and a JSON message.
Live keys and test keys
Every account has two modes, and the key you present is what picks one. A key starting with vp_live_ works in live mode, where the coins are real. A key starting with vp_test_ works in test mode, where the same endpoints run against the test networks and nothing is worth anything.
The two modes share nothing. Objects are created in the mode of the key that made them and are only ever listed to that mode; asking a live key for a test charge, payment link or invoice answers 404, exactly as if it did not exist, and the other way round. Deposit addresses are derived separately per mode, so a test payment can never land where real money is held.
To make a key of a mode, switch the dashboard to that mode with the toggle in the sidebar and create the key there. Test mode needs a payout address of its own, which is set on the payment settings page while in test mode.
curl https://api.velirapay.com/v1/charges \ -H "Authorization: Bearer vp_test_…" \ -H "Accept: application/json"
GET /v1/account reports which mode the key is in under meta.mode, so a client can show what it is working with.
Which account is this key for?
GET /v1/account describes the account behind the key: whether it is a personal account or an organization, its public profile (display name, logo, website, support email, brand color), the default currency, the payment tolerances and, under meta.accepted_assets, the coins it has a wallet for.
See the account endpoint and a full response →
Rate limits
Each key may make 120 requests per minute. Going over answers with 429 and a Retry-After header saying how long to wait. MCP server requests count towards the same limit.