A method and apparatus for performing multi-factor authentication of a merchant system by a commerce platform are described. The method may include authenticating the commerce platform to a cloud services provider, the cloud services provider providing a private communications network for use by the commerce platform and the merchant system. The method may also include receiving, by the commerce platform, an authentication request from the merchant system, wherein the request received from the merchant system originates from the private communications network provided by the cloud services provider, and wherein the authentication request uses an encryption key. Furthermore, the method may include determining, by the commerce platform, validity of the encryption key used in the authentication request for the merchant system, and in response to origination of the authentication request occurring from within the private communications network and determining validity of the API key, authenticating the merchant system as an authorized system for performing an operation requested by the authentication request using the commerce platform.