Create a customer, then pass its id as customer_id on POST /v1/payment_intents.

merchantId and tenantId are always set from your credentials; any values in the body are replaced. Creating is not deduplicated, so search first to reuse a returning customer.

Merchant users work on their own merchant's customers. Tenant owners and admins can work on any merchant in their tenant by passing ?merchantId=. A merchant in another tenant returns 404. Other roles are refused.

Authenticate with a dashboard session token, or a merchant-pinned secret key in X-API-Key. A secret key acts only for its own merchant: anything it creates belongs to that merchant and records the key as the actor, and another merchant's customers return 404. Publishable, payout_write and agent_onboarding keys are refused.