Peak Gateway API
REST API for Peak Gateway merchants, partners and agents. OAuth2 operations accept an access token from client credentials or API-key exchange. UserSession operations require a signed-in Peak Gateway dashboard user. CustomerSession operations require a customer Firebase ID token with App Check; account handoff alternatives require both the account credential and its bound checkout session token. Neither customer authentication path accepts integration OAuth tokens. Amounts are integer minor currency units.
Authentication
- API Key: ApiKeyHeaderAuth
- HTTP: Basic Auth
- API Key: CheckoutSessionTokenAuth
- API Key: ClientSecretAuth
- API Key: RecoverySessionTokenAuth
- OAuth 2.0: OAuth2
- HTTP: Bearer Auth
- HTTP: Bearer Auth
- API Key: FirebaseAppCheck
- API Key: CheckoutAccountCredential
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Api-Key |
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | basic |
Checkout session token bound to this checkout session and merchant
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Session-Token |
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Setup-Intent-Client-Secret |
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Session-Token |
Security Scheme Type: | oauth2 |
|---|---|
OAuth Flow (clientCredentials): | Token URL: https://api.peakgateway.co/auth/oauth2/token Scopes:
|
Access token of a signed-in Peak Gateway dashboard user; not available to API keys or client credentials
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Customer-tenant Firebase ID token; requires App Check and is not an integration OAuth or dashboard user token
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Firebase App Check proof accompanying the customer Firebase ID token
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Firebase-AppCheck |
Short-lived customer account handoff credential; requires its bound checkout session token
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Checkout-Account-Credential |