Authentication

GET /v1/balance
Host: api.weavpayments.com
Authorization: Bearer wv_test_••••••••••••••••

Live and test keys

The key’s prefix decides the mode. Live keys never see test data, and test keys never see live data.

Managing keys

• Create, rename, regenerate and delete keys under Developers in the dashboard.
• Weav shows a key in full only once, when you create it. Store it in your secrets manager right away.
• Regenerating a key stops the old one immediately.
• You can limit a key to your servers’ addresses. See IP allowlist.
• Never put a key in a mobile app, a browser, or a public repository. Call Weav only from your server.

IP allowlist

Limit a key to your servers’ addresses, so a key that leaks can’t be used from anywhere else. We recommend it for every live key.

• Set it per key under Developers in the dashboard, when you create or edit the key. An empty list allows any address.
• Up to 20 entries: IPv4 or IPv6 addresses, or ranges in CIDR notation, such as 203.0.113.10 or 203.0.113.0/24. Separate them with commas, spaces or new lines.
• Use the public address your servers call out from: the one Weav sees. Behind a NAT gateway, load balancer or proxy, that’s its public address, not your server’s private one.
• A change to a live key’s allowlist is emailed to your account’s Owners and Developers.
• Try it on these docs calls Weav from your browser, so a key with an allowlist gets 403 there. Use a test key without one.

A request from any other address gets 403:

{
    "code": "4030000",
    "success": false,
    "message": "Requests with this key must come from an address on its allowlist."
}

To call Weav, use the host name api.weavpayments.com, never an IP address: Weav’s own addresses can change. Webhooks come to you from fixed addresses; see IP addresses.

Errors