Send traffic from your code
The dashboard is for reading and deciding. Your traffic should come from your own systems. This is the minimum integration.
Click any step to read what happens there and what can refuse it.
Idempotency, every time
Every mutation needs an idempotency-key header (1 to 255 characters). Same key and same body: the original response is returned without re-running anything. Same key and a different body: 409 idempotency_conflict. Use your own order id in the key so a retry after a timeout can never create a second payment.
The three headers
x-api-key: pehmen_test_… (or Authorization: Bearer pehmen_test_…)
x-pehmen-organization: <workspace id> (a UUID, on the overview and the Quickstart screen)
x-pehmen-environment: test (a key can only name its own environment)
Rate limits: a key has a bucket of 50 with 10 refills per second; a 429 rate_limited carries retry-after.
What a key cannot do
Anything that needs a person present: approve, release, publish, manage keys, manage the team, request Live. Those permissions are not grantable to a key, and a key that hits one is told so: this action requires an interactive session with fresh two-factor verification (API keys cannot step up).
The full endpoint table is in Endpoints.