Authentication
To start working with the Cepta API, all clients must authenticate themselves.
Overview
An access key public key is a secure method of communication with our API. You can generate keys from the Dashboard once you’ve created your account and logged in.
Here’s an example of how to include the secret key in your API requests:
Make requests
All requests must contain the following headers:
X-Access-Key- an app token that you generate in the Dashboard.X-Access-Signature- a request signature in the HEX format and lowercase.X-Access-Ts- a number of seconds since Unix Epoch in UTC.
Sign requests
The value of the X-Access-Signature header is generated with the sha256 HMAC algorithm using a secret key on the bytes obtained by concatenating the following information:
- A timestamp (value of the
X-Access-Tsheader) taken as a string. - An HTTP method name in upper-case, e.g.
GETorPOST. - URI of the request without a host name, starting with a slash and including all query parameters, e.g.
/api/v1/pay/confirm-status?TransactionRef=exampleRef - Request body, taken exactly as it will be sent. If there is no request body, e.g., for
GETrequests, do not include it.
Always protect your secret keys These keys grant access to your project and its associated resources, so they should never be shared or exposed in public repositories. Treat your keys as sensitive information to avoid unauthorized access to your account.