ZZanoraDocs

Set up

Sign up as a seller, confirm your email, and receive your provider id, settlement wallet and API key.

From the console

At console.zanora.dev, choose Seller, enter your email, organisation name and a password, then click the emailed link. The console shows your provider API key once. Copy it into a password manager before you leave the page.

From the API

Terminal
curl -s -X POST https://api.zanora.dev/v1/signup -H 'content-type: application/json' -d '{
  "role": "seller",
  "email": "ops@acme.example",
  "organizationName": "Acme OCR",
  "website": "https://acme.example",
  "password": "optional — enables console sign-in"
}'
# → 202 {"signupId":"sgn_…","status":"pending","expiresAt":"…","emailSent":true}

Nothing is created until the emailed link is opened, or the token from it is sent to POST /v1/signup/verify:

JSON
{
  "status": "completed",
  "role": "seller",
  "tenant": { "kind": "provider", "id": "prv_3652ec9e…", "name": "Acme OCR", "walletId": "wal_546563d4…" },
  "credential": { "keyId": "akey_…", "token": "zk.akey_….…", "scopes": ["capabilities:write", "payouts:write", "…"] }
}
You getWhat it is
tenant.id (prv_…)your provider id. Routes take it from your key, so you rarely type it
tenant.walletIdyour settlement wallet: every sale lands here, net of the fee
credential.tokenyour root provider key, shown once

Include your website

Operators look at it when deciding on verification. A real, working site is the easiest thing to approve.

Keys for your servers

Mint a narrower key for each deployment rather than shipping the root key:

Terminal
curl -s -X POST https://api.zanora.dev/v1/auth/keys -H "x-api-key: $ROOT_KEY" \
  -H 'content-type: application/json' \
  -d '{"label":"prod-mcp-server","scopes":["capabilities:read","capabilities:write","payments:write","receipts:read"],"expiresInSeconds":7776000}'

A server using zanoraSeller().sell() needs capabilities:write (to publish and reconcile) and payments:write (for the payment routes). A server using only the Express middleware needs just payments:write. Keep payouts:write off anything that runs unattended. See Accounts and API keys.

Next: ask to be verified.