Platform overview

This page covers what is common to every Cashela API: environments, credentials, authentication, request conventions and how to get help. Product-specific details are in the Pay-In and Pay-Out guides.

Environments

Environment	Base URL	Purpose
Sandbox	`https://sandbox-api.cashela.com`	Development and testing. No real money.
Production	`https://production-api.cashela.com`	Live transactions with real money.

Each environment has its own credentials, data and references. Nothing created in sandbox exists in production.

Credentials

You create your credentials yourself in the Developer Portal of your Cashela Business dashboard (cashela.com/dashboard/developers):

One card per environment, Sandbox and Production, each with its own API keys.
Each key has an API key (public identifier) and an API secret (shown only once, when you create or rotate the key).
IP whitelist per key: required for new production keys (at least one IP or CIDR range of YOUR servers, not your customers’; the checkout page your customers open is never restricted); optional in sandbox, where an empty list accepts any IP.
Actions per key: Disable / Enable, Rotate (the old key keeps working for 7 days), Revoke.
Your sandbox is created automatically. Production keys are issued after your go-live request is approved.

Step-by-step guide: Get started.

Authentication

Every request uses HTTP Basic authentication over HTTPS: the api_key is the username and the api_secret is the password. Pay-In and Pay-Out use the same credentials.

curl https://sandbox-api.cashela.com/api/v1/pay-in/deposit-creation/countries \
  -u "$CASHELA_API_KEY:$CASHELA_API_SECRET" \
  -H "Accept: application/json"

Response	Meaning
`401 Unauthorized.`	Missing or wrong credentials, credentials of the other environment, or a disabled, revoked or expired key.
`403 IP address is not allowed.`	The key has an IP whitelist and the request came from another address.
`403 Insufficient permissions.`	The key may not use that endpoint.
`429`	Too many requests: wait for the seconds in `Retry-After`.

Details: Authentication.

Conventions

JSON request and response bodies, UTF-8.
Country codes: ISO 3166-1 alpha-3 (MEX, USA, BRA). Currency codes: ISO 4217 (USD, MXN, BRL).
Field names in snake_case (first_name, external_identifier).
GET endpoints take query parameters only.
Send your own correlation id in the X-Trace-Id header and quote it to support.

Security good practices

Keep secrets on your servers only; never in browsers, mobile apps or repositories.
Use one key per system and rotate keys periodically.
Set an IP whitelist on production keys.
Verify the signature of every webhook before trusting it. See Pay-In webhooks.
Make webhook handlers idempotent and retry safely with your own identifiers. See Idempotency.

Guides

Need help?

Contact Cashela support with the X-Trace-Id and the transaction reference.