Getting Started
To use Anton Payments, you need a merchant account. This article walks you through the sign-up process, getting sandbox access, and finding your way around the merchant portal.
Signing Up
Anton Payments accounts are provisioned by the Anton team. To get started:
Contact the Anton team -- Reach out through antonpayments.com/contact to begin the onboarding process.
Complete your merchant application -- You will go through a Know Your Business (KYB) verification process. This involves submitting business documentation, ownership details, and compliance information.
Receive your sandbox credentials -- Once your application is approved (or provisioned by your account manager), you will receive access to the sandbox environment where you can begin integrating.
Sandbox access is not self-service. Your account manager will provision your merchant account and ensure everything is set up correctly.
Generating API Keys
API keys are created in the merchant portal. Here is how to generate your first key:
Log in to the merchant portal.
Navigate to Settings > API Keys.
Select the environment (sandbox or production).
Click Create Key and give it a descriptive name (for example, "Development server" or "Staging CI").
Important: The full API key is displayed only once at creation time. Anton hashes keys with SHA-256 before storage, so the original key cannot be retrieved later. Copy it immediately and store it in your secrets manager or environment variables.
API Key Formats
API keys are prefixed to indicate their environment:
ak_test_-- Sandbox keys for testing and development. No real money moves.ak_live_-- Production keys for real payouts with real money.
Testing Your Setup
Once you have your API key, verify it works by fetching your merchant profile:
curl https://api.antonpayments.dev/v1/merchant \ -H "Authorization: Bearer ak_test_your_key_here"
If you get back your merchant profile, your authentication is working and you are ready to start building.
Security Best Practices
Keep your API keys secure by following these guidelines:
Rotate keys regularly -- Create a new key, update your systems, then revoke the old one. This limits exposure if a key is leaked.
Use separate keys per environment -- Never use production keys in development. Create dedicated test keys for sandbox.
Restrict to server-side only -- API keys should only be used from your backend servers. Never include them in mobile apps, browser JavaScript, or client-side code.
Monitor key usage -- Review your API key list periodically in the merchant portal. Revoke any keys that are no longer in use.
Revoking a Key
If a key is compromised, revoke it immediately from the merchant portal:
Navigate to Settings > API Keys.
Find the key and click Revoke.
Confirm the revocation.
Revoked keys stop working immediately and the action cannot be undone. Make sure your systems are updated with a new key before revoking the old one.