Create a user
Creates a new Spritz user under the authenticated integrator.
The response includes the user’s API key (ak_...), which is returned only once at creation - store it securely.
Conflict: If a user with the given email already exists, the request fails with 409 Conflict. In that case, use Spritz Connect (POST /v1/integrator/connect/sessions) to have the existing user authorize this integrator.
Authorizations
HMAC signature authentication for backend integrators.
Required Headers:
- X-Integrator-Key: Integrator API key (format: int_...)
- X-Signature: HMAC signature (format: sha256={hex})
- X-Timestamp: Unix timestamp in milliseconds
- Authorization: Bearer {user-api-key}
Signature Algorithm: HMAC-SHA256
Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}
- timestamp: Unix timestamp in milliseconds
- METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
- path: Request path (e.g., /v1/transactions)
- bodyHash: SHA256 hex digest of request body (empty string if no body)
Timestamp Tolerance: ±5 minutes (300 seconds)
Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...
Integrator API key (format: int_...) used with HMAC authentication
Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.
Body
Response
Response for status 200
The internal ID of the newly created user
"6a749a054c3b8fc5da595d1f"
Email address of the newly created user
"user@example.com"
The user's API key (ak_...). Returned only once at creation - store it securely.
"ak_N2FjZTk3ZjMtsTWiZF00MGU0LWIxYTMtMTY0ZmM3MzJiNTdm"