Set up
Create a provider account
Sign up as a seller, confirm your email, and receive your provider id, settlement wallet and API key.
From the console
At console.zanora.dev↗, choose Seller, enter your email, organisation name and a password, then click the emailed link. The console shows your provider API key once. Copy it into a password manager before you leave the page.
From the API
curl -s -X POST https://api.zanora.dev/v1/signup -H 'content-type: application/json' -d '{
"role": "seller",
"email": "ops@acme.example",
"organizationName": "Acme OCR",
"website": "https://acme.example",
"password": "optional — enables console sign-in"
}'
# → 202 {"signupId":"sgn_…","status":"pending","expiresAt":"…","emailSent":true}Nothing is created until the emailed link is opened, or the token from it is sent to POST /v1/signup/verify:
{
"status": "completed",
"role": "seller",
"tenant": { "kind": "provider", "id": "prv_3652ec9e…", "name": "Acme OCR", "walletId": "wal_546563d4…" },
"credential": { "keyId": "akey_…", "token": "zk.akey_….…", "scopes": ["capabilities:write", "payouts:write", "…"] }
}| You get | What it is |
|---|---|
tenant.id (prv_…) | your provider id. Routes take it from your key, so you rarely type it |
tenant.walletId | your settlement wallet: every sale lands here, net of the fee |
credential.token | your root provider key, shown once |
Include your website
Operators look at it when deciding on verification. A real, working site is the easiest thing to approve.
Keys for your servers
Mint a narrower key for each deployment rather than shipping the root key:
curl -s -X POST https://api.zanora.dev/v1/auth/keys -H "x-api-key: $ROOT_KEY" \
-H 'content-type: application/json' \
-d '{"label":"prod-mcp-server","scopes":["capabilities:read","capabilities:write","payments:write","receipts:read"],"expiresInSeconds":7776000}'A server using zanoraSeller().sell() needs capabilities:write (to publish and reconcile) and payments:write (for the payment routes). A server using only the Express middleware needs just payments:write. Keep payouts:write off anything that runs unattended. See Accounts and API keys.
Next: ask to be verified.