Busha API requests use a small set of custom headers in addition to standard HTTP headers such as Content-Type. This page explains the headers you will most commonly encounter and when to use them.
Authorization
The Authorization header is required for most authenticated requests. It carries your business Secret API Key as a Bearer token.
Use it for quotes, transfers, customers, recipients, balances, and most other business-owned resources. See Make your first request.
Pledge endpoints are the exception. They require a customer-scoped OAuth2 access token in this header instead of your business Secret Key. See Pledges: Before you begin. X-BU-PROFILE-ID
Include X-BU-PROFILE-ID when a request should act on behalf of a specific customer rather than your business account.
This header is optional on most endpoints. Omit it and the request uses your business account by default. See Customers.
X-BU-PUBLIC-KEY
Use X-BU-PUBLIC-KEY instead of Authorization for client-facing or lightly authenticated endpoints, especially payment requests.
Your public key is safe to expose in frontend code. Use it when creating or retrieving payment requests and when working with the Commerce SDK. See Retrieve a payment request.
Never use your Secret Key where a Public Key is expected, and never expose your Secret Key in client-side code.
X-BU-Version
X-BU-Version lets you select a specific request and response schema version for endpoints that have changed over time.
This header is optional. If you omit it, Busha uses the default version for the endpoint. It is currently used on recipients endpoints and other endpoints that support versioned schemas. The older X-BU-VERSION header is deprecated and should not be used.
X-Request-Id
X-Request-Id is a response header. Every API response includes a unique identifier for that call.
Use it when you contact Busha support or need to debug a specific request. Request IDs are retained for 21 days. See Request IDs.
x-bu-signature
x-bu-signature is a webhook-specific header that Busha sends to your webhook endpoint. You do not send it to Busha.
Use it to verify that an incoming webhook came from Busha. Compute an HMAC-SHA256 signature of the raw request body using your webhook secret, then compare it with this header value. See Set up webhooks.
Quick reference
