List the IP allow-list
curl -X GET "https://test-api.kashier.io/v2/ip-address"{}Returns the IP addresses allowed to call Kashier with your secret key.
Read this first when a working integration suddenly returns 403. Every secret-key
call is checked against this list, and an IP that is not on it is refused with
403 Unauthorized IP address — which looks like an authentication problem but is not.
Because an empty list allows every IP, the allow-list is opt-in and silent until
someone adds the first entry; from that moment every server you call from must be
listed, including new deployment targets, NAT gateways and CI runners.
Dashboard (JWT) sessions are never IP-checked — only secret-key callers are.
Authorization
secretKey Merchant secret key used to identify the merchant, obtained from Kashier's dashboard. Pass the raw secret key value in the Authorization header (NOT a "Bearer" token).
In: header
Query Parameters
Search term.
Page number.
Page size.
Field to sort by, e.g. createdAt.
Sort direction — 1 ascending, -1 descending.
Value in
- 1
- -1
Response Body
application/json
application/json
application/json
application/json
application/json
Update a user's secret keys PUT
Updates the secret keys held for one dashboard user. Requires the API-key permission on your user's role. Treat this as destructive until you have confirmed its behaviour with Kashier. Kashier has…
Add an IP to the allow-list POST
Adds one address to the allow-list. Adding the first entry switches the allow-list on. Until then every IP is allowed; the moment one entry exists, every other IP is refused with 403 Unauthorized I…