Authentication

API Key Authentication

The SafePays API uses API keys to authenticate requests. You can generate and manage your API keys from the SafePays Dashboard.

Obtaining Your API Key

Log in to your SafePays Dashboard
Navigate to Settings → API Keys
Click Generate New API Key
Give your key a descriptive name (e.g., "Production Server", "Development")
Copy the key immediately - it won't be shown again

Important Security Notice

Never expose your API key in client-side code
Never commit API keys to version control
Rotate keys regularly for security
Use environment variables to store keys

Using Your API Key

Include your API key in the request body for all API calls:

curl -X POST https://app.safepays.com/api/customer \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "your_api_key_here",
    "name": "John Doe",
    "email": "john.doe@example.com"
  }'

const response = await fetch('https://app.safepays.com/api/customer', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    api_key: process.env.SAFEPAYS_API_KEY, // Use environment variable
    name: 'John Doe',
    email: 'john.doe@example.com'
  })
});

import os
import requests
import json

api_key = os.environ.get('SAFEPAYS_API_KEY')  # Use environment variable

response = requests.post(
    'https://app.safepays.com/api/customer',
    headers={'Content-Type': 'application/json'},
    data=json.dumps({
        'api_key': api_key,
        'name': 'John Doe',
        'email': 'john.doe@example.com'
    })
)

<?php
$api_key = $_ENV['SAFEPAYS_API_KEY'];  // Use environment variable

$data = [
    'api_key' => $api_key,
    'name' => 'John Doe',
    'email' => 'john.doe@example.com'
];

$ch = curl_init('https://app.safepays.com/api/customer');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));

$response = curl_exec($ch);
curl_close($ch);
?>

Authentication Errors

When authentication fails, you'll receive a 401 Unauthorized response:

{
  "error": "Invalid API Key"
}

Common causes:

Missing API key in request
Incorrect API key
Expired or revoked API key
API key from wrong environment (test vs production)

Best Practices

1. Use Environment Variables

Never hardcode API keys in your source code:

// .env file
SAFEPAYS_API_KEY=your_api_key_here

// Your application
require('dotenv').config();
const apiKey = process.env.SAFEPAYS_API_KEY;

# .env file
SAFEPAYS_API_KEY=your_api_key_here

# Your application
from dotenv import load_dotenv
import os

load_dotenv()
api_key = os.getenv('SAFEPAYS_API_KEY')

// .env file
SAFEPAYS_API_KEY=your_api_key_here

// Your application
<?php
$dotenv = Dotenv\Dotenv::createImmutable(__DIR__);
$dotenv->load();
$api_key = $_ENV['SAFEPAYS_API_KEY'];
?>

2. Secure Storage

Store API keys in secure key management services (AWS Secrets Manager, Azure Key Vault, etc.)
Use encrypted environment variables in production
Limit API key access to necessary personnel only