Authentication

• Base URL: https://api.ensopay.io
• Operator endpoints — server-to-server calls you make directly. These require Authorization: Bearer <OPERATOR_SECRET_KEY> (we provision this key for you — keep it server-side only): /session/deposit, /session/withdraw, /depositor/create, /depositor/:externalUserId/check, and — when headless withdrawals are enabled for your operator — /withdraw/options, /withdrawals/:sessionRef/execute, /withdrawals/:sessionRef, and /withdrawals/:sessionRef/cancel.
• Session-scoped endpoints — /depositor/address and /withdraw/direct-transfer are called by the hosted widget, not your backend. They take no Bearer key; they are authenticated by the sid (session id) in the request body.
• The same OPERATOR_SECRET_KEY signs/verifies all webhooks.
• Response shape: the operator/session endpoints (/session/deposit, /session/withdraw, /depositor/address, /withdraw/direct-transfer, /withdraw/options, and /withdrawals/:sessionRef/*) wrap their result as { "status", "message", "data": { … } }. GET /chain and the /admin/* endpoints return the raw object/array (no envelope).