Get credentials in the Hub, then use the get started API v1 or get started API v2 reference for authentication, request signing, errors, base URLs, and rate limits.

Solidgate APIs are available in two versions.

Solidgate API v1 powers card and alternative payments, checkout solutions, Billing 1.0 subscriptions, products and prices, reports, and risk tools. Solidgate API v2 is recommended for new integrations that use the unified host, Bearer authentication, and scoped API keys. Coverage continues to expand across platform and product domains. API v1 HMAC signature

Authenticate with channel Public and Secret keys and an HMAC-SHA512 signature on every request. Domain-specific hosts serve payments, subscriptions, checkout, reports, and risks.

Includes

Card payments Alternative payments Payment Page and Link Products and prices Billing 1.0 subscriptions Reports Fraud prevention Webhooks and files API v2 Bearer token

Authenticate with a Bearer token. Keys can apply to the whole account or selected channels, with fine-grained permissions. All operations use one host and a consistent resource/action path pattern.

Includes

Customers Invoices Payment instruments Subscriptions API keys and channels Webhooks Antifraud lists Routing and reports

API overview

Full request and response contracts remain in the API Reference.

Area API v1 API v2
Authentication merchant and signature headers.
HMAC-SHA512 over publicKey + body + publicKey.		 Authorization: Bearer with the API secret.
No request signature.
API keys Channel keys with prefixes api_pk_ / api_sk_. Account or channel-bound keys with prefixes akey_ / asec_.
Scopes by channel and permission. Zero-downtime rotation.
Host and path Multiple hosts, for example pay.solidgate.com, gate.solidgate.com, subscriptions.solidgate.com. Action after /api/v1/. Single host https://api.solidgate.com/v2. Pattern /{resources}/{action}.
HTTP method Depends on the operation (POST, GET, and others). POST for all operations.
Errors Nested error object with numeric-style codes, for example 3.02. Flat envelope with named codes, for example PERMISSION_DENIED, optional context, and a request-id header.
Webhooks Validate with webhook Public and Secret keys using the same HMAC-SHA512 model as API requests. Manage endpoints via API v2. Validate with the endpoint secret using HMAC-SHA256 in the Signature header.
Best fit Payment processing, Payment Page and Link, products and prices, Billing 1.0, classic reports and risk APIs. New integrations on the unified v2 host, scoped API keys, platform management, and expanding product domains in the API Reference.

Retrieve your credentials

To call the Solidgate API, even in the sandbox, you need credentials from the Solidgate Hub .

  • Solidgate API v1
    Public and Secret keys from Developers > channel details. Prefixes api_pk_ / api_sk_. Webhook keys use wh_pk_ / wh_sk_.
  • Solidgate API v2
    Create keys under Developers > API v2 > API keys. Prefixes akey_ / asec_. Restrict by channel when needed.
Hub To generate API keys
  1. Go to Developers.
  2. Select the version from the dropdown.
    • For API v1: select the channel you need, then on the Channel details page find the API keys.
    • For API v2: go to API keys, click on Create API key, name your keys and optionally select a channel or multiple channels, then click on Create.
  3. Copy your API keys.
Never expose Secret keys in client-side code or public repositories. Use them only in secure server-side environments.

Generate signature

Request signing applies to Solidgate API v1 only. Build the HMAC-SHA512 generate signature API v1 and send it with the merchant and signature headers.

Solidgate API v2 uses Bearer authentication and does not require a request signature.

Next steps

API Reference

Authentication, structure, errors, rate limits, and OpenAPI downloads.

Webhooks

Configure endpoints, verify signatures, and handle event delivery.

Reporting

See how API v1 and API v2 reporting approaches differ before exporting data.


API logs

API logs capture request and response records in the Hub. Use them to troubleshoot issues, monitor traffic, and investigate unexpected API usage.

Search request and response body content directly on the API logs page. Combine body search with filters for status code, method, host, and date range to isolate a specific entry.

Hub To find and view API log entries

  1. Go to Developers > API logs.
  2. Enter a search query for terms or phrases in the request and response bodies.
    • Use single terms, phrases, wildcards, or boolean logic (AND, OR, exclude with -).
    • Optionally narrow results with Status, Method, Host, and date range filters.
  3. Find the log entry you need and click on it.
  4. View log entry details, including Status, Method, Path, Host, IP address, and Date (UTC).
  5. Expand Request body and Response body to see the JSON payloads sent and received.

Body search always covers request and response together. It does not support separate request-only or response-only search, or regular expressions. The query length is limited to 1,000 characters. Colons and other special characters are treated as plain text, not operators.