Skip to main content
Before an account can move value, a person must accept the AroPay data-privacy terms: what data the platform collects, who it is shared with, and what the confidential rail does and doesn’t hide. Read them at aropay.aro.media/terms; no sign-in needed.

​
What requires acceptance

Until the account has accepted the current version, these endpoints return 403 terms_not_accepted: The check is tied to the account, so it applies to API keys and sessions alike, and it runs before the body is validated. Everything else works without acceptance: reads, wallets, API keys, your profile, and voiding a letter (which refunds you).

​
Accepting

Sign in to the dashboard and accept under Settings, or from the prompt the dashboard shows on your first transaction. Acceptance is session-only: an API key cannot accept on your behalf, so for a key-only integration, sign in once and accept before its first run. Sandbox and production accounts are separate; accept in each environment you use.
The platform records the version you accepted, a hash of the exact text you were shown, the time, and the IP address and browser user agent you accepted from, as the record of your consent.

​
Checking status

GET /me/terms accepts either credential:
required: true means the endpoints above will refuse. Once accepted, accepted carries { version, acceptedAt } and required is false. document holds the full text (title, key points, sections) if you want to render it yourself.

​
When the terms change

A new version comes with a new version and effectiveDate, and every account must accept it before its next transaction; until then the gated endpoints return 403 terms_not_accepted again. Treat that code as needing a person, not a retry: alert someone to sign in and accept. POST /me/terms takes the version and contentHash from GET /me/terms, so a page still showing an older text can’t accept it. A stale pair returns 409 terms_version_mismatch; fetch the terms again and accept the current version.