Authentication

Aurax Pay uses API keys to authenticate requests. Every call to the /v1/* endpoints must include your key in the x-api-key header.

Sending your API key

Include the key on every request as an HTTP header:

curl https://api.auraxpay.net/v1/payments \
  -H "x-api-key: axp_live_YOUR_KEY_HERE"

const response = await fetch("token-string">'https:"token-comment">//api.auraxpay.net/v1/payments', {
  method: "token-string">'POST',
  headers: {
    "token-string">'Content-Type': "token-string">'application/json',
    "token-string">'x-api-key': process.env.AURAX_API_KEY,
  },
  body: JSON.stringify({ amount: 5000, channel: "token-string">'MPESA', ... }),
})

Key types

Permissions

Each API key is scoped to a set of permissions. When generating a key from the dashboard, you select what it can do. A key without a required permission returns 403 Forbidden.

Key security

Aurax Pay stores only a SHA-256 hash of your key — the plaintext is shown once at creation and never again. If you lose a key, revoke it and generate a new one.

• Rotate keys regularly in production
• Use separate keys per service or environment
• Revoke immediately if you suspect compromise
• Store in environment variables, never in source code

Authentication errors