Authentication
All API requests are authenticated with a secret key sent as a Bearer token.
Authorization: Bearer np_test_sk_c1eade91543213b33cc2199a1fb4178df184d4030a0f07ee
Key types
| Key | Prefix | Purpose |
|---|---|---|
| Public | np_test_pub_ / np_live_pub_ | Safe to expose in client-side code |
| Secret | np_test_sk_ / np_live_sk_ | Server-side only. Never ship to a browser or mobile app. |
Scopes
Credentials are scoped to their application. Default scopes are
payments:write and payments:read.
Rotation and revocation
Generating a new pair for an environment revokes the previous active pair for that environment. You can also revoke from the API Keys page at any time. Secrets are stored only as hashes.
Never share Daraja credentials
NixPay never issues, and never asks for, a merchant's Safaricom consumer secret or passkey in an API
call. Merchant credentials are configured once in the merchant account and encrypted at rest.
NixPay documentation · A Supreonix product
Back to introduction