Merchant Onboarding

Onboarding takes a merchant from “I want to accept stablecoins” to working API keys in a few minutes.

The flow

1. Sign in — email-OTP at the merchant dashboard. This logs you into an in-app smart account (ERC-4337, sponsored gas) derived from your email.
2. SIWE — the dashboard requests a login payload (GET /v1/auth/login-payload), you sign it, and POST /v1/auth/verify mints a JWT. Your smart account address is the settlement destination — there is no separate payout-recipient field; payouts always go to it.
3. Issue an API key — create an sk_live_* server key under Settings → API keys. The raw key is shown once; only its SHA-256 hash + 12-char prefix are stored.
4. Configure webhooks — register an endpoint and store the signing secret (whsec_*).

Authentication model

Credential	Lifetime	Use	Where it lives
OTP code	~10 min	One-time login	Email
JWT	24 h	Dashboard / /v1/merchants/me/*	Browser; then re-OTP
sk_live_*	Until revoked	Server-to-server (/v1/sessions, /v1/webhooks)	Your server, never the client
pmc_live_*	Until revoked	Publishable paymaster client ID	Safe to ship in client bundles

sk_live_* server keys default to the sessions:create scope. pmc_live_* is not an API key and cannot create sessions — it’s a paymaster client ID sent as X-Client-Id on paymaster JSON-RPC calls, protected by a per-key origin + chain allowlist (see Paymaster). The two are issued independently, not in pairs.

SIWE handshake

After OTP login you sign a SIWE message to bind your wallet:

business.harness.stablecoinx.com wants you to sign in with your Ethereum account:
0xabc...123

Sign in to StablecoinX

URI: https://business.harness.stablecoinx.com
Version: 1
Chain ID: 8453
Nonce: <server-generated>
Issued At: 2026-05-26T17:00:00Z

Profile

Configurable from the dashboard: business display name (shown on the checkout page), webhook endpoints + secrets, and paymaster clients/allowlist. The bound smart account is the settlement wallet; settled funds arrive as sUSDe.

API keys

Prefix	Use	Notes
sk_live_*	Server-side	Default scope sessions:create. Bearer token or X-Api-Key.
pmc_live_*	Client-side	Paymaster client ID; origin + chain allowlisted. Not an API key.

Create and revoke keys from the dashboard at any time (DELETE /v1/merchants/me/api-keys/:id). Webhook signing secrets rotate via POST /v1/webhooks/:id/rotate-secret with a grace window — roll your verifier to accept old + new, then drop the old.

Next

• Quickstart — make your first API call.
• Session Payment — the primary product surface.
• Paymaster — sponsor gas for your users.