Getting started

Authentication

Every call carries the same four headers. Three of them identify your business; the fourth says the body is JSON.

Headers

Header	Value
Content-Type	`application/json`
api-key	Your business API key
secret-key	Your business secret key

Every request

Content-Type: application/json
api-key: <your api key>
secret-key: <your secret key>

Where the keys come from

Open the dashboard and go to Business Setting → API Keys. The pair shown there belongs to the business you have selected, so if you run more than one business, check the selector at the top of the page before you copy anything.

Test and live

Each business has two key pairs, one for the sandbox and one for live collections. The dashboard's Test / Live switch decides which pair is on screen. Only the credentials change between environments: paths, request bodies and event payloads are identical, so the same integration code runs against both.

Testing without moving money. In sandbox, use the payment simulator in your dashboard to fire a collection into a virtual account. It exercises the same webhook delivery and the same transaction records as a real payment.

Keeping keys safe

Call the API from your server. A secret key in a browser or a mobile binary is a secret key in public.
Keep keys in environment configuration, not in your repository.
Use the sandbox pair everywhere except production.
If a key is exposed, rotate it from the dashboard and update your deployment.