Authentication

PayX uses API keys to authenticate server-side requests. You can view and manage your API keys in the PayX Dashboard.

API Keys (v2)

PayX uses version 2 (v2) API keys for all merchant integrations. Legacy keys (px_live_... or px_test_... without _v2_) are rejected. Every account has two sets of keys:

Test Keys (px_test_v2_<uuid>): Use these in sandbox and development environments. No real funds are moved.
Live Keys (px_live_v2_<uuid>): Use these in production environments. Real money will be moved.

Key Type	Prefix Format	Example
Live Secret Key	`px_live_v2_`	`px_live_v2_YOUR_LIVE_KEY_HERE`
Test Secret Key	`px_test_v2_`	`px_test_v2_YOUR_TEST_KEY_HERE`

Never expose Secret Keys in client-side code. Secret API keys (px_live_v2_... / px_test_v2_...) must never be embedded in browser JavaScript, mobile applications, or public code repositories.To accept payments securely in the browser, your backend must call POST /api/v1/checkout to generate a 30-minute scoped token (px_checkout_...). See PayX JS Checkout for details.

Authenticating Requests

All API requests must be made over HTTPS. To authenticate, include your Secret Key in the x-api-key header or the standard Authorization: Bearer header.

Option 1: `x-api-key` Header (Recommended)

curl -X POST https://payx.company/api/v1/charge \
  -H "x-api-key: px_live_v2_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 10.00,
    "phoneNumber": "0551234987",
    "network": "MTN"
  }'

Option 2: `Authorization: Bearer` Header

curl -X POST https://payx.company/api/v1/charge \
  -H "Authorization: Bearer px_live_v2_YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 10.00,
    "phoneNumber": "0551234987",
    "network": "MTN"
  }'

Getting Started

Authentication

Webhooks

Authentication

API Keys (v2)

Authenticating Requests

Option 1: `x-api-key` Header (Recommended)

Option 2: `Authorization: Bearer` Header

​API Keys (v2)

​Authenticating Requests

​Option 1: x-api-key Header (Recommended)

​Option 2: Authorization: Bearer Header

API Keys (v2)

Authenticating Requests

Option 1: `x-api-key` Header (Recommended)

Option 2: `Authorization: Bearer` Header