Health

View as Markdown

Verifies an API key and reports the mode it resolves to. It runs no payment engine, so use it as a connectivity and credential check. It is what the WooCommerce plugin's Test Connection button calls.

GET    https://api.worthypayments.com/v1/ping

Authentication: any valid API key. No scope required; a valid key is enough.

Request#

bash

curl https://api.worthypayments.com/v1/ping -H "x-api-key: sk_live_xxx"

Response#

json

{
  "object": "ping",
  "mode": "live",
  "key_type": "secret",
  "merchant_account_id": "cmt3yfavu00013iokngc9rjtw",
  "api_version": "2026-01-01",
  "scopes": ["payments:charge", "payments:read"],
  "unrestricted": false
}

Field	Notes
`object`	Always `"ping"`.
`mode`	`"test"` or `"live"`, the mode encoded in your key's prefix.
`key_type`	`"publishable"`, `"secret"`, or `"restricted"`.
`merchant_account_id`	The account the key resolves to.
`api_version`	The version this request was served under. See Versioning.
`scopes`	`resource:action` strings this key can actually reach. A `pk_` always reports exactly `["payments:charge"]`.
`unrestricted`	`true` only for a legacy secret key with no permission map, which retains full access.

There is no ok field. An earlier revision of this page documented one; it is not returned. Branch on the HTTP status instead. A 200 means the key is valid, and a 401 carries api_key_invalid or api_key_required. if (response.ok) against the JSON body silently evaluated undefined and never ran, which is why this is called out rather than quietly corrected. (response.ok on a fetch Response is a different thing and is fine.)

scopes and unrestricted are returned, and are the quickest way to explain a 403 permission_denied. They are derived from the same rules the scope guard enforces, so the listing cannot disagree with the gate.

A publishable key returns the same shape with "key_type": "publishable".

Errors#

If the key is missing or invalid you get a 401 with the standard envelope:

json

{ "error": { "type": "invalid_request_error", "code": "api_key_invalid", "message": "Invalid, expired, or revoked API key." } }

See Errors.

From the SDK#

The SDK exposes the same check:

const info = await wp.ping();
// → { object: 'ping', mode: 'live', key_type: 'publishable',
//     merchant_account_id: 'cmt3yfavu00013iokngc9rjtw', api_version: '2026-01-01',
//     scopes: ['payments:charge'], unrestricted: false }

Use it on startup to confirm you've wired the correct key and mode before taking a real payment.