Credentials & Security

API key types, storage, rotation, and authentication headers.

DigetPay uses API keys for payment APIs and Bearer tokens for portal management APIs. Keep them separate and server-side only.

API key types

Key type	Header	Used for
EdfaPay gateway key	`x-api-key`	Payment link, embedded direct sale, status, refund
DigetPay merchant key (`DG…`)	`x-api-key`	`POST /payment/hosted/initiate` (split / redirect)
Portal Bearer token	`Authorization: Bearer …`	Webhook CRUD, credential rotation via Portal API

📘
Most merchants use the gateway key for hosted checkout and embedded integration. Confirm key type with your onboarding contact.

Payment API authentication

{
  "headers": {
    "x-api-key": "YOUR_MERCHANT_API_KEY",
    "Content-Type": "application/json"
  }
}

Rule	Detail
Server-side only	Never embed in mobile apps or browser JavaScript
Per environment	Separate keys for Fin staging and production
Rotation	Update your server before revoking the old key

How merchants receive credentials

Channel	When
Onboarding	Issued after KYC and merchant setup
Dashboard	Settings → API Credentials — Dashboard guide
Portal API	`GET /merchant/account/credentials` for partners

Retrieve credentials (Portal API)

sequenceDiagram
    autonumber
    participant Merchant as Your Backend
    participant DigetPay as DigetPay Portal API

    Merchant->>DigetPay: GET /merchant/account/credentials<br/>Authorization: Bearer {portal_token}
    DigetPay-->>Merchant: apiKeyMasked, apiKeyPlain?, issuedAt, environment
    Note over Merchant: Store apiKeyPlain once — not retrievable later

Key rotation

sequenceDiagram
    participant Merchant as Merchant Portal
    participant DigetPay as DigetPay Portal API
    participant Prod as Your Servers

    Merchant->>DigetPay: POST /merchant/account/credentials/rotate
    DigetPay-->>Merchant: apiKeyPlain (one-time)
    Merchant->>Prod: Update secrets manager

❗️
Critical: apiKeyPlain is shown once. Store immediately in your secrets manager.

Portal API Reference →

Security best practices

Do	Don't
Use environment variables / vault	Commit keys to Git
Rotate on staff departure or leak	Share keys in Slack or email
Use HTTPS for webhooks	Expose keys in frontend code
Log request IDs, not keys	Log full `x-api-key` values

❗️
Emergency: If a key is leaked, rotate immediately and contact [email protected].

Related

Updated 27 days ago

Did this page help you?