# Getting Started with AuxCORE

Welcome to **AuxCORE** — the merchant payment platform behind **AuxPAY**. This guide covers how merchants and developers integrate card, ACH, payment links, and the no-code SDK.

---

## What is AuxCORE?

AuxCORE is the payment orchestration platform behind AuxPAY. Merchants use the dashboard for Virtual Terminal, payment links, and reporting. Developers integrate via:

- **Public REST API** (`/api/v1/public/*`) — ERP, plugins, server-side automation
- **No-code SDK** (`auxVault.js`) — hosted PCI fields in any website
- **Dashboard APIs** (`/api/v1/*`) — admin operations with JWT

Core capabilities:

- **Payment processing** — Card, ACH, auth/capture, voids, refunds
- **Payment links & invoicing** — Hosted pay pages and Text-to-Pay
- **Customer vault** — Stored customers and payment methods
- **Recurring billing** — Subscription plans
- **Multi-gateway routing** — FluidPay, NMI, TSYS, and more (configured per merchant)
- **PCI-safe tokenization** — Card data collected via `vault.auxcore.net`, not your server

---

## Merchant workflow (AuxCORE)

Typical merchant setup:

1. **Admin provisions merchant** — Gateway, pricing, and VT settings in the dashboard
2. **Credentials** — Gateway keys saved under Merchants → Gateways (or deferred for external gateway onboarding)
3. **API keys** — Merchant creates keys in **Settings → Developer & Integrations → API Keys** (Secret for REST and the WooCommerce plugin, SDK Public for website embed)
4. **Test** — Virtual Terminal or the SDK tester in Settings → Developer & Integrations
5. **Go live** — Switch to production host and live gateway credentials

Developers integrating ERP/checkout use the **Public API** with a **Secret API key**. Website embeds use an **SDK Public key** (`lpk_live_…`) — never expose secret keys in HTML.

---

## Quick Start (5 minutes)

The [Quick Start](./quickstart.md) takes you from an API key to an approved, looked-up and refunded Sandbox payment in five copy-paste steps:

1. **Get a secret API key** — **Settings → Developer & Integrations → API Keys**
2. **Test the connection** — `POST /testConnection`
3. **Tokenize a test card and charge it** — `POST /tokenize-card`, then `POST /transaction` with the `pciToken`
4. **Look up the transaction** — `GET /transaction/:id`
5. **Refund it** — `POST /refund`

For an **external integration team**, invite them as **Merchant Integrator** (Team). That role can create SDK keys, use the live SDK tester, and configure webhooks without access to Virtual Terminal, transactions, or team management. **Staff** does not include the developer portal.

[Start the Quick Start →](./quickstart.md)

---

## Base URLs

See [Environments](./environments.md) for every host and URL.

| Environment | Public API base |
|-------------|-----------------|
| **Sandbox** | `https://uat.auxcore.net/api/v1/public` |
| **Production** | `https://app.auxcore.net/api/v1/public` |

---

## Required headers

Server integrations send both headers on every authenticated Public API call:

```http
x-api-key: YOUR_API_KEY
Content-Type: application/json
```

No tenant header is needed: the tenant and merchant are resolved from the key (`X-Tenant-ID` is ignored on `/api/v1/public/*`). Tenant-wide ERP keys (`lv_erp_…`) also send `X-Merchant-ID` to pick the merchant.

Customer-facing hosted payment links (`GET /payment-links/:linkId`, etc.) do **not** require an API key — those are browser flows.

---

## Security best practices

1. Never expose **secret** API keys (`api-…`) in client-side code
2. Use **SDK Public keys** (`lpk_live_…`) for website embeds only
3. Collect cards with the **PCI SDK** so card numbers never reach your server — the API only charges a `pciToken`
4. Validate webhook signatures (`X-Webhook-Signature`)
5. Rotate API keys periodically

---

## Test card numbers (Sandbox)

See the [test card list](./testing.md#test-cards) on the Testing page.

---

## Additional resources

- [Authentication](./authentication.md)
- [Environments](./environments.md)
- [Quick Start (detailed)](./quickstart.md)
- [SDK embed guide](./sdks.md)
- [All endpoints](../reference/endpoints.md)
- [Developer Portal](https://uat.auxcore.net/settings/developer/sdk) — live SDK tester (when logged in)

---

**Need help?** Contact support@auxcore.net