Getting started

Authentication

Every request carries your account's API key as a Bearer token.

GET /api/v1/account HTTP/1.1
Host: el-b.com
Authorization: Bearer elb_sk_…
Accept: application/json

Your key

One key per account. It starts with elb_sk_ and acts for your account: it can create, cancel and confirm your payments.
Shown once. El-B keeps only a fingerprint of it. Lost it? Regenerate it.
Regenerate replaces the key at once; your usage history stays. Pause refuses every call until you resume it.
Verified accounts only. The key works while your account is verified by an official document, has a RIP, and is not suspended. Otherwise calls answer 403.

Keep it secret

Call the API from your server only. A key in a web page, a mobile app or a public repository lets anyone confirm your payments: regenerate it at once if it leaks.

Store it in an environment variable (ELB_API_KEY in these docs), send it over HTTPS only, and never log it.

When it fails

Status	Code	Why
`401`	`unauthenticated`	No key, an unknown key, or a paused one.
`403`	`account_not_verified`	The account is no longer verified by an official document, or has no RIP.
`403`	`account_suspended`	The account is suspended.

See Errors for the shape of every error.