Quickstart

1. Get a key

   Sign in at the integrator console with Google or with a six-digit code sent to your email. There are no passwords. The first time, the console then asks for the integrator details: whether you are a person or a company, the matching document, and the terms. That key is live. For a sandbox key, switch the console to Sandbox and create one there; the same sign-in manages both. A sandbox key looks like this:

   text

   tcr_test_sk_AbCdEfGhIjKlMnOp.<43-character secret><6-character checksum>
   

   The full key is shown once. Store it on your server, for example as TUCOPRAMP_API_KEY.

2. Check the key

   GET /consumer returns the consumer and key behind the request.

   bash

   curl https://sandbox.api.ramp.tucop.xyz/consumer \
     --header "X-TuCOPRamp-Key: $TUCOPRAMP_API_KEY"
   

   json

   {
     "consumer": {
       "id": "con_0bdy554f0x9szsmatwdnz8z6gb",
       "name": "acme-wallet",
       "products": ["pay"],
       "scopes": ["wallet.read", "wallet.write"]
     },
     "api_key": {
       "id": "key_2x1gfkx2jb9gpswvvthee0t7hf",
       "public_id": "AbCdEfGhIjKlMnOp",
       "kind": "sk",
       "environment": "test",
       "expires_at": null
     }
   }
   

   A 401 with code: "invalid_api_key" means the key is wrong, revoked, expired, or for the other environment. See Authentication. Ids such as con_... are described in API conventions.

3. Read the document types

   GET /document-types lists the identity documents a party from a country can use.

   bash

   curl "https://sandbox.api.ramp.tucop.xyz/document-types?country=COL&party_type=individual" \
     --header "X-TuCOPRamp-Key: $TUCOPRAMP_API_KEY"
   

   From here, open a party session and follow Payments.

4. Try it in the playground

   Open the API reference tab, pick Get the consumer for the calling API key, paste your test key into X-TuCOPRamp-Key and send the request.

   The playground only calls the sandbox, and the request goes straight from your browser to TuCOP: your key does not pass through the docs host. It is checked against your own public address, so a key limited to IP ranges that do not include it is refused with 403 api_key_ip_not_allowed. Never paste a live key into the playground.

Endpoints that act for a person (parties, destinations, quotes, payments, limits, withdrawals, deposits) also need a party session, which the playground cannot open for you. See Parties. If TuCOP linked your integrator's own payments provider account, the pay endpoints take the key alone: see Pay from your own payments provider account. What the sandbox has, and what it does not, is on Sandbox. If an AI coding agent writes your integration, have it read Rules for AI agents first.