Authentication

Every request authenticates with a secret key in the Authorization header:

curl https://api.ouipay.com/v1/transactions \
  -H "Authorization: Bearer sk_test_51M2s..."

Key types

Secret keys grant full access to your account's resources. They are secrets : store them in a secrets manager, never in source control, client bundles, or mobile apps.

Requests that need extra proof

Money-moving endpoints additionally require an Idempotency-Key header (see Idempotency): this is not authentication but a replay guard.

Rotating keys

Dashboard → Developers → API keys → Rotate. Rotation is two-phase:

1. A new key is issued; the old key remains valid for a grace period.
2. Update your integrations to the new key, then revoke the old one.

IP allowlisting

Optionally restrict live keys to a set of source IPs in the dashboard. Requests from other addresses return 403 with error.code = "FORBIDDEN". Recommended for production.

Errors