The key is the business
No field to set, and therefore no field to forge.
Three endpoints.
No business id anywhere.
Your own site, bot or agent can ask for an exact amount and get back a URL that takes it.
Start your business
Keys are minted under Developer, and shown once.
A call, end to end
One POST, and a URL that takes $45.
Worked example
POST /api/fuime/v1/payment_links
Request
Authorization: Bearer fuime_sk_…
name
"Saturday lesson"
amount
"45.00"
venture_id
No such field
201 Created
"…/pay/atlas/saturday-lesson"
Dollars or amount_cents, $1 to $10,000, USD.
JSON
The blast radius
A key cannot name a business.
No route and no body carries a venture id. A leaked key touches one business: its own.
Cannot move money
It creates links and takes them down. No endpoint pays anything out.
Cannot read the ledger
No transactions, no receipts, no totals. It cannot say what you earned.
Cannot see a person
No names, no email addresses, no ages, no guardian record.
The surface
Three endpoints. That is all of them.
| Path | Method | What it does |
|---|---|---|
| /api/fuime/v1/me | GET | Whose key it is, and whether it can sell |
| /api/fuime/v1/payment_links | GET | The live links this key made |
| /api/fuime/v1/payment_links | POST | Make one, $1 to $10,000, USD |
| /api/fuime/v1/payment_links/:id | DELETE | Take down one it made |
A key only sees and deletes the links it made. A misplaced decimal is refused, not clamped. A deleted link stops taking money and the record survives.
The limits
Four numbers you will hit.
Keys cost nothing and are not a plan feature.
Every key starts with this
Prefixed like Stripe's and GitHub's, so a secret scanner can match it.
fuime_sk_
Live keys per business
Not a resource limit. Three integrations is more than most have.
10
Live links per key
Stops a retry loop filling your dashboard overnight. Take some down and make more.
250
Requests a minute
Per key, across all three endpoints.
120
What is missing
Four things this API does not have.
Finding that out from a page is cheaper than finding it out from a build.
No separate practice environment
Every key is live. Make a link for a dollar, then delete it.
No client libraries
Nothing to install, in any language. JSON over HTTPS, and whatever handles that.
No webhooks out
Nothing tells your code when a link is paid. You poll the list, or watch the ledger.
No machine-readable spec
No OpenAPI document to generate a client from. This page is the documentation.