Skip to main content

Auth and Signatures

This public documentation covers authentication methods (API Key and Signatures) for integration APIs.

Authentication Methods​

Backend services integrating with SodaPop APIs can choose between two authentication methods:

Include the x-depay-api-key header in your requests. You can generate your API key in the dashboard at https://app.sodapopfi.com/.

2. Request Signature​

Include the following headers:

  • x-depay-signature
  • x-depay-timestamp

Verification rules for Request Signature:

  1. Signature must recover ownerAddress.
  2. Timestamp must be within ±5 minutes.
  3. Timestamp must be unique per owner (replay protection).

Replay key:

  • (ownerAddress, timestamp)

Note: ownerAddress must always be provided in the request body (for POST) or query parameters (for GET/DELETE) regardless of the authentication method used.

Internal API Note​

Session-based frontend auth exists for the internal dashboard, but those endpoints are not part of public integration docs.

Signed Message Format​

DePay API Request Signature
<CANONICAL_JSON>

Canonical JSON object structure:

{
  "action": "invoice.create",
  "ownerAddress": "0x...",
  "timestamp": 1714200000000,
  "payload": {}
}

EIP-712 Meta-Transaction Signatures​

For setFeeMetaTx and setPayoutMetaTx, the owner wallet signs typed data with:

  • name: PaymentFactory
  • version: 1
  • verifyingContract: 0x79972d16fe9Aac806caB10377DD0c27781aE0491
  • chainId: selected chain

See detailed endpoint examples in API v1 sections.