Authentication & Authorization

Learn how to securely authenticate your API requests and manage your account credentials.

API Key vs. API Secret

Once your developer account is linked to a B2B Partner account, you will find two essential pieces of information in your API Keys dashboard. It is crucial to understand their distinct roles.

API Key (Public Key)

Purpose: To identify your application.

This key is sent with every API request you make to us. It answers the question: "Who is making this request?". It is considered "public" but should still be kept secure.

API Secret (Secret Key)

Purpose: To verify incoming webhooks.

This key is highly confidential and **must never be exposed publicly**. You use it on your server to verify that webhook notifications (e.g., for payment confirmations) genuinely come from CashPay. It answers the question: "Is this request really from CashPay?".

Making Authenticated Requests

All requests to the CashPay B2B API must be authenticated using your **API Key**. Authentication is performed by including an `Authorization` header with the `Bearer` scheme.

Standard Request Header

cURL

Authorization: Bearer <YOUR_API_KEY>

For quick testing of `GET` endpoints, you can also pass your key as a query parameter: ?apiKey=<YOUR_API_KEY>.

Securing Your Keys: Best Practices

Your API keys provide access to powerful operations on your account. It is critical to keep them secure. The best practice is to store your keys in environment variables on your server and load them into your application from there. **Never hard-code your keys directly in your source code.**

Example .env file

cURL

# .env
CASHPAY_API_KEY="CP-LIVE-xxxxxxxxxxxx"
CASHPAY_API_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Code Examples

Here are complete examples showing how to make an authenticated request to the `/api/v1/b2b/account/balance` endpoint in various languages, using environment variables.

Node.js (using fetch)

JavaScript

const apiKey = process.env.CASHPAY_API_KEY;
const url = 'https://api.cashpay-all.com/api/v1/b2b/account/balance';

async function getBalance() {
    if (!apiKey) {
        console.error("CASHPAY_API_KEY is not set in environment variables.");
        return;
    }

    try {
        const response = await fetch(url, {
            method: 'GET',
            headers: {
                'Authorization': `Bearer ${apiKey}`,
                'Content-Type': 'application/json'
            }
        });

        if (!response.ok) {
            const errorData = await response.json();
            throw new Error(errorData.error || `API Error: ${response.status}`);
        }

        const data = await response.json();
        console.log('Success:', data);
    } catch (error) {
        console.error('Failed to fetch balance:', error);
    }
}

getBalance();