Authentication
Authenticate API requests with a Chiwa Pay secret key.
Use a secret key on every API request.
Header
Authorization: Bearer sk_xxxKeep your API key secret
Do not send a secret key from a browser or mobile app.
Requirements
| Requirement | Status |
|---|---|
| Merchant | approved |
| Payment method | active |
| Secret key | Not revoked |
Security
| Area | Description |
|---|---|
| Storage | Store it on your server. |
| Logging | Mask secret key values. |
| Rotation | Revoke the old key after the new key is active. |
| IP allowlist | Restrict a key to server IPs or CIDR ranges such as 203.0.113.10 or 203.0.113.0/24. |
Example
curl "https://api.chiwapay.com/payments/f2b1d5b0-7b1f-4c5d-9c37-93f0c8f6a001" \ -H "Authorization: Bearer sk_xxx"