Authentication

Get your API key

Every request to the QuataPay API is authenticated with a merchant API key. Create and manage keys from the merchant panel under Developer → API keys.

• Test keys start with qpay_test_ and only touch test mode: they work on the /gateway/sandbox/… paths and are refused with 403 on the live paths.
• Live keys start with qpay_live_ and move real money — protect them like a password. They work on the /gateway/… paths and are refused with 403 on the sandbox paths.

A key is shown once, when you create it, and only the account owner can create one. Copy it straight into an environment variable on your server (for example QUATAPAY_API_KEY); QuataPay stores only a hash and cannot show it again.

Bearer token header

Send the key in the standard Authorization header on every request:

Authorization: Bearer qpay_test_xxxxxxxxxxxxxxxxxxxxxxxx

A missing, malformed or revoked key answers 401. A key used on the wrong mode's path, or a key of a suspended merchant, answers 403.

Rotation and revocation

Create a new key, switch your deployment over, then revoke the old one. Revoke a leaked key immediately from the same panel; a revoked key is refused.

Never embed keys in client code

API keys belong on your backend, in environment variables. Never put one in browser code, a mobile app, a URL, a log or git, and never use a NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_ variable for it. For browser checkout, have your server create the payment and redirect to the hosted checkout, or use a payment link. A mobile app calls your own backend, which calls QuataPay.