Authentication
Each merchant generates an API Key and API Secret in the LOMA console (the secret is shown only once — store it safely).
Every request must include these headers:
| Header | Required | Description |
|---|---|---|
X-Api-Key | ✅ | Merchant API Key |
X-Api-Secret | ✅ | Merchant API Secret |
Idempotency-Key | required for send | Idempotency key; a repeated request with the same key returns the first result and never sends twice |
Content-Type | ✅ | application/json |
Example
curl -X POST https://loma-dev.acorners.com/api/v1/merchant/message/send \
-H "X-Api-Key: lk_xxxxxxxxxxxx" \
-H "X-Api-Secret: xxxxxxxxxxxxxxxxxxxxxxxx" \
-H "Idempotency-Key: order-12345" \
-H "Content-Type: application/json" \
-d '{"customerExternalId":"C10086","text":"Your OTP is 395217"}'
Auth failures
| Case | Response |
|---|---|
| Invalid or disabled key/secret | HTTP 401, code = INVALID_API_KEY |
:::tip Idempotency-Key Always send an idempotency key for OTP / notifications. Duplicate requests from retries won't deliver twice. Use a unique key per business action (e.g. an order id); recommended validity is 24 hours. :::