The following steps show how to get sandbox credentials. These credentials work only with the Trustap sandbox environment.
After you successfully complete a full transaction in the sandbox environment, your Trustap integration specialist will provide your production credentials. These credentials work only with the Trustap production environment.
To get started using the Trustap API, complete these steps.
Use our contact form to get in touch with us.
To help us understand your use case, include the following.
* What does your company do?
* What problem can Trustap solve for you?Our integration specialist will contact you as soon as possible.
Your Trustap integration specialist sends you an invitation to access the Trustap Dashboard. Follow the link to create your account.
Dashboard email
Add the following parameters to your account.
| Integrator supplied URL | Description |
|---|---|
| Webhooks | The URL where Trustap will send webhook events for your account. |
| Redirect URIs | The URL users are redirected to after completing payment. This must match the redirect URI used in your flow. Trustap supports wildcard URIs. For example, if you provide https://www.sams-bikes.com/*, you can redirect to https://www.sams-bikes.com/login_path/. URLs you add must include the Base URL configured for your account. |
Your credentials are available on the Trustap Dashboard. Use these credentials to authenticate access to the Trustap API.
| Label | Credential | Description | Example |
|---|---|---|---|
 | Client Secret: <CLIENT_SECRET> | A unique string beginning with cs_test_ for the sandbox environment and cs_ for the production environment. Used together with the Client ID to obtain OAuth access tokens for creating full Trustap users. | cs_test_99kzqyecamf8s12345pzczfny0 / cs_test_01kzqy09876srnk1ypzczfny0 |
 | Client ID: <CLIENT_ID> | A unique string beginning with cid_. Used together with the Client Secret to obtain OAuth access tokens for creating full Trustap users. | cid_05kkdsuienhfc9b5w124567sss |
 | API key: <API_KEY> | Used to authenticate requests to the Trustap API. A unique string beginning with capi_test_ for the sandbox environment and capi_ for the production environment. | capi_test_sdrfg7edf253443435 / capi_refdfgfg25swd4sdfs: |
The API key is required for all API calls. The Client ID and Client Secret are only required when you're implementing OAuth flows or creating full Trustap users.
Keep your API credentials secure. Never hard-code API credentials into your application or commit them to source control. Store them in environment variables or a dedicated secrets manager.
Authenticate API requests using HTTP Basic Authentication. Supply your API key as the username and leave the password blank.
curl -i -X POST 'https://api.test.trustap.com/v2/guest_users' \
-u '<API_KEY>:' \
-H 'Content-Type: application/json' \
-d '{
"email": "bert.gray@example.com",
"first_name": "Bert",
"last_name": "Gray",
"country_code": "ca",
"tos_acceptance": {
"unix_timestamp": 1736441841,
"ip": "127.0.0.1"
}
}'With HTTP Basic Authentication, your API key is supplied as the username and the password is left blank. Remember to include the trailing colon (:). For example, --user 'capi_sdrfg7edf253443435:'.
| Code | Error | Description |
|---|---|---|
invalid_api_key | Invalid API key | The provided API key is not recognized or authorized. Review your key to ensure it complete and correct. |
invalid_basic_auth_base64 | Invalid Base64 encoding in Basic Authentication | The value provided in the Authorization header is not a valid Base64-encoded string. If using cURL, use the -u flag (curl -u '<API_KEY>:'). cURL handles Base64 encoding automatically. If setting the Authorization header, append a trailing colon so the value becomes <API_KEY>:. Base64-encode the entire string (<API_KEY>:) and set the header to Authorization: Basic <BASE64_RESULT>. See our Authentication guide for more information. |