> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate every bluSwap API request using your merchant x-api-key header. Learn required headers, IP whitelisting, and next steps.

Every request to the bluSwap API must be authenticated using your merchant `x-api-key`. You include this key as a header in each call there is no OAuth flow or token exchange. Retrieve your key from the bluSwap merchant dashboard, and treat it with the same care you would a password.

> [!WARNING]
>
> Keep your `x-api-key` private at all times. Never embed it in client-side code, mobile app bundles, or public repositories. Anyone who obtains your key can make API calls on your behalf.

## Generate via Dashboard

Use this method during development, testing, or whenever you need a one-off key without writing code. Log in to the merchant dashboard, navigate to the API settings page, and click the Generate Key button to issue a new X-API-Key instantly.

**1. Log In to the Merchant Dashboard**

Go to [https://bluswap.co](https://bluswap.co) and sign in with your registered email address and password.

**2. Navigate to Settings**

From the main navigation, go to **Settings → IP/Secret**.

**3. Generate a New X-API-Key**

Locate the **X-API Key** section and click the **Generate Key**. A new key is generated and activated immediately.

**4. Copy the New Key**

Copy the newly generated X-API-Key from the dashboard and add it to your application configuration or use it directly for testing.

## Sample request

The example below shows a basic authenticated request that retrieves virtual accounts for your merchant profile.

```bash cURL theme={"dark"}
curl --request GET 'https://api.bluswap.co/api/v1/merchants/get/virtual_accounts' \
  --header 'x-api-key: YOUR_SECRET_KEY' \
  --header 'Content-Type: application/json'
```

Replace `YOUR_SECRET_KEY` with the actual key from your dashboard.

## Required headers

Include the following headers on your API requests:

**x-api-key** `string` *required*

Your merchant secret key. Obtain this from the bluSwap dashboard. Required on every request.

**Content-Type** `string`

Set to `application/json` for all requests that send or receive a JSON body. Required for JSON requests.

**X-Real-IP** `string`

Your whitelisted public IP address. Required when the endpoint enforces IP-based access control.

> [!NOTE]
>
> Requests will fail if the IP address you supply in `X-Real-IP` has not been whitelisted for your merchant account. Contact bluSwap support to add or update your allowed IP addresses.

## Next steps

Once authentication is working, continue with the following:

* **Configure Payout callbacks** — Set up your webhook URL so bluSwap can push payout event notifications to your server. See [Payout Webhook Configuration](/docs/payouts/webhook-configuration.md).
* **Explore Collections** — Start accepting incoming payments via UPI, cards, and net banking. See the [Collections overview](/docs/collections/overview.md).
* **Explore Payouts** — Create contacts and initiate outbound fund transfers. See the [Payouts overview](/docs/payouts/overview.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.