> ## Documentation Index
> Fetch the complete documentation index at: https://www.bitnob.dev/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Bitnob API requests authenticate with an `X-Auth-Client` API key header against https://api.bitnob.com.
> Always use the sandbox environment for testing. Never put live API keys in sample code.
> Money amounts are integers in the smallest unit of the currency (satoshis for BTC, cents for fiat). Never use floats.
> Every state-changing request takes a client-supplied `reference` and must be treated as idempotent on retry.
> Quotes expire. Re-quote rather than reusing a stale quote id.

# Set up your account

> Create your Bitnob account, issue Bitnob Business API credentials for sandbox and production, store them safely, and confirm they work.

This guide takes you from no account to working Bitnob Business API credentials: register, complete your profile, then create a `CLIENT_ID` and `CLIENT_SECRET` pair and confirm it works.

> [!NOTE]
>
> Building on Bitnob Enterprise instead? See [Set up your Bitnob Enterprise account](https://www.bitnob.dev/docs/platform/account-setup.md).

## Create your account

**1. Register**

Go to [accounts.bitnob.com](https://accounts.bitnob.com/auth/signup) and enter a valid email address.

**2. Confirm your email**

Enter the confirmation code we send you.

**3. Set a password**

Use at least 12 characters, with letters, numbers, and symbols.

**4. Sign in to the dashboard**

Go to [app.bitnob.com](https://app.bitnob.com/). The dashboard holds your API keys, balances, transactions, and webhook logs.

![Bitnob account setup process](https://mintcdn.com/bitnob/Sor5dTHMKj4jWOVo/images/login.svg?fit=max\&auto=format\&n=Sor5dTHMKj4jWOVo\&q=85\&s=69235740df18c5cbf09e1da5548a21e0)

> [!TIP]
>
> Invite your colleagues from account settings before you start building. Shared access avoids credential sharing later.

## Complete your profile

Open the **Profile** section and add:

* Your company or project name.
* A contact phone number and a mailing address. We use both for invoices and notifications.

## Submit compliance documents

Sandbox works without verification, under default limits. Production does not.

To unlock production and raise your limits, open **Identity & Compliance** and submit:

* Your business registration documents.
* Identity documents for the account holders.
* Your settlement bank account details.

Review usually takes 24 to 48 hours. We email you the result.

## Create Bitnob Business API credentials

Your credentials are a pair: a `CLIENT_ID` that identifies you, and a `CLIENT_SECRET` that signs your requests.

**1. Open the API keys page**

In the dashboard, select **Settings** > **API Keys**.

**2. Create a key**

Select **Create Key** and complete the form.

**3. Copy both values now**

We show the secret once. Copy it before you close the dialog.

**4. Repeat for the other environment**

Create a separate key for sandbox and for production.

> [!WARNING]
>
> We cannot recover a lost secret. If you lose one, revoke the key and create a new one.

### How sandbox and production differ

Both environments use the same base URL, `https://api.bitnob.com`. Your `CLIENT_ID` is the same in both. Only the `CLIENT_SECRET` differs.

The secret you sign with selects the environment. There is no environment header and no separate host.

| Value | Sandbox | Production |
| - | - | - |
| Base URL | `https://api.bitnob.com` | `https://api.bitnob.com` |
| `CLIENT_ID` | Same | Same |
| `CLIENT_SECRET` | Sandbox secret | Production secret |
| Funds | Simulated | Real |

> [!WARNING]
>
> A production secret in a test job moves real money. Keep the two secrets in separate configuration, and never load both into the same process.

Sandbox data resets from time to time. Do not use it for records you need to keep.

### Store your credentials

Keep credentials out of source control and out of client applications.

```bash theme={null}
BITNOB_CLIENT_ID=yourClientId
BITNOB_CLIENT_SECRET=yourSecretKey
```

In production, read them from a secret manager rather than a file. [API keys and credential security](https://www.bitnob.dev/docs/getting-started/api-best-practices/api-keys-and-credentials.md) covers storage, rotation, and leak response.

### Verify your Business API credentials

Call `/api/whoami`. It returns your authenticated account details and nothing else, so it is safe to call at any time.

```bash theme={null}
curl -X GET "https://api.bitnob.com/api/whoami" \
  -H "Content-Type: application/json" \
  -H "x-auth-client: <CLIENT_ID>" \
  -H "x-auth-timestamp: <ts>" \
  -H "x-auth-nonce: <nonce>" \
  -H "x-auth-signature: <signature>"
```

A `200` with your company details confirms that your credentials and your signing are correct.

A `401` means the signature, the timestamp, or the client id is wrong. The [Quickstart](https://www.bitnob.dev/docs/getting-started/quickstart.md) shows a working signing script and lists the common causes.

> [!NOTE]
>
> To sign this request from application code, copy a signing helper for Node.js, Go, or Python from [Authentication](https://www.bitnob.dev/api-reference/authentication/authentication.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.