Reference

Authentication

The AspiPay API uses Bearer tokens. Send your secret key in the Authorization header on every request.

Bearer token

bash

Authorization: Bearer sk_test_...

sk_test_…

Uses the mock rail. No real money. Available immediately.

sk_live_…

Real settlements. Only available after KYB approval.

Never ship secret keys to a browser. Server-side only.
Load them from environment variables, never a config file.
Rotate immediately if a key is exposed. Old keys can be revoked from the dashboard.
Scope each integration to its own key so you can revoke without impact.

Optional. For each key you can restrict inbound traffic to a set of CIDR ranges. Requests from other IPs return 401 unauthorized.

json

{
  "error": "unauthorized",
  "message": "Missing or invalid API key"
}