Prerequisites

Bitstac account

• Active Bitstac business workspace with status enabled.
• Merchant API enabled for your business (Bitstac admin turns this on — merchants cannot self-enable).
• You are the workspace owner to manage keys, webhooks, and settings in Developers.

Keys and environments

• Test keys (bst_test_) — use for integration development.
• Live keys (bst_live_) — require your business to be fully KYB-verified. Otherwise the API returns kyb_not_complete.
• Store secrets in a vault or server env vars — never in mobile apps or frontends.

Security controls

• Configure an IP allowlist in Developers → Settings when you are ready to restrict traffic (empty allowlist = all IPs).
• Webhook endpoints must be HTTPS and able to verify X-Bitstac-Signature (see Webhooks).

Scopes

Keys are created with default scopes from your settings. For customer KYB you need:

• customers:read — list and retrieve
• customers:write — create, update, documents, stakeholders, submit

balances:read may appear as an available scope but has no routes yet.

Rate limits

Merchant Bearer endpoints are limited to 120 requests per minute per credential. See Errors & rate limits.