API key setup
Generate an API key and secret key in your dashboard, keep them on your server, and use them to sign requests.
Get your API keys
-
Log in to your dashboard
Sign in to your Gafiapay business dashboard.
-
Open API Settings
Go to the API Settings section.
-
Generate a key pair
Click Generate New API Key to create an API key and a secret key.
-
Save both keys
Copy them somewhere secure right away. You can't view the secret key again.
Key format
Your API key is a 64-character string of letters and digits. Your secret key is longer, 128 characters. Neither has a prefix:
3f9a1c2e7b4d0a8f6e5c1b2a9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0eKeep your keys safe
- Never share them. Don't commit keys to version control or post them anywhere public.
- Use environment variables or a secure configuration file to store them.
- Rotate them regularly. Generate new keys, update your applications, then retire the old ones.
Anyone with your secret key can sign requests as your business. Never send it to a browser or a mobile app; have your front end call your own backend instead.
Load keys from the environment
Put both keys in a .env file (or your platform's secret store) and read them when you sign a request:
// .env file
GAFIAPAY_API_KEY=sbp_live_1234567890abcdef1234567890abcdef
GAFIAPAY_SECRET_KEY=your_secret_key_here
// Usage in your code
require('dotenv').config();
const apiKey = process.env.GAFIAPAY_API_KEY;
const secretKey = process.env.GAFIAPAY_SECRET_KEY;
// Example API request
const axios = require('axios');
const headers = {
'x-api-key': apiKey,
'x-signature': generateSignature(requestBody, timestamp, secretKey),
'x-timestamp': Date.now(),
'Content-Type': 'application/json'
};
const response = await axios.post('https://api.gafiapay.com/api/v1/external/account/generate', requestBody, { headers });# .env file
GAFIAPAY_API_KEY=sbp_live_1234567890abcdef1234567890abcdef
GAFIAPAY_SECRET_KEY=your_secret_key_here
# Usage in your code
import os
from dotenv import load_dotenv
import requests
load_dotenv()
api_key = os.getenv('GAFIAPAY_API_KEY')
secret_key = os.getenv('GAFIAPAY_SECRET_KEY')
# Example API request
headers = {
'x-api-key': api_key,
'x-signature': generate_signature(request_body, timestamp, secret_key),
'x-timestamp': str(int(time.time() * 1000)),
'Content-Type': 'application/json'
}
response = requests.post('https://api.gafiapay.com/api/v1/external/account/generate', json=request_body, headers=headers)// .env file
GAFIAPAY_API_KEY=sbp_live_1234567890abcdef1234567890abcdef
GAFIAPAY_SECRET_KEY=your_secret_key_here
// Usage in your code
$apiKey = $_ENV['GAFIAPAY_API_KEY'];
$secretKey = $_ENV['GAFIAPAY_SECRET_KEY'];
// Example API request
$headers = [
'x-api-key: ' . $apiKey,
'x-signature: ' . generateSignature($requestBody, $timestamp, $secretKey),
'x-timestamp: ' . round(microtime(true) * 1000),
'Content-Type: application/json'
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.gafiapay.com/api/v1/external/account/generate');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($requestBody));
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);# .env file
GAFIAPAY_API_KEY=sbp_live_1234567890abcdef1234567890abcdef
GAFIAPAY_SECRET_KEY=your_secret_key_here
# Usage in your code
require 'dotenv'
require 'net/http'
require 'json'
Dotenv.load
api_key = ENV['GAFIAPAY_API_KEY']
secret_key = ENV['GAFIAPAY_SECRET_KEY']
# Example API request
uri = URI('https://api.gafiapay.com/api/v1/external/account/generate')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Post.new(uri)
request['x-api-key'] = api_key
request['x-signature'] = generate_signature(request_body, timestamp, secret_key)
request['x-timestamp'] = (Time.now.to_f * 1000).to_i.to_s
request['Content-Type'] = 'application/json'
request.body = request_body.to_json
response = http.request(request)// .env file
GAFIAPAY_API_KEY=sbp_live_1234567890abcdef1234567890abcdef
GAFIAPAY_SECRET_KEY=your_secret_key_here
// Usage in your code
import java.util.Properties;
import java.io.FileInputStream;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.net.URI;
Properties props = new Properties();
props.load(new FileInputStream(".env"));
String apiKey = props.getProperty("GAFIAPAY_API_KEY");
String secretKey = props.getProperty("GAFIAPAY_SECRET_KEY");
// Example API request
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.gafiapay.com/api/v1/external/account/generate"))
.header("x-api-key", apiKey)
.header("x-signature", generateSignature(requestBody, timestamp, secretKey))
.header("x-timestamp", String.valueOf(System.currentTimeMillis()))
.header("Content-Type", "application/json")
.POST(HttpRequest.BodyPublishers.ofString(requestBodyJson))
.build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());Test your key
List one of your virtual accounts. It's read-only, so it's a safe first call. A 200 response means your key works; a 401 tells you what's wrong (see authentication errors).
curl -X GET 'https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1' \
-H 'x-api-key: your_api_key' \
-H 'x-timestamp: 1678901234567'const res = await fetch('https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1', {
headers: {
'x-api-key': process.env.GAFIAPAY_API_KEY,
'x-timestamp': Date.now().toString(),
},
});
const data = await res.json();import os, time, requests
res = requests.get(
"https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1",
headers={
"x-api-key": os.environ["GAFIAPAY_API_KEY"],
"x-timestamp": str(int(time.time() * 1000)),
},
)
data = res.json()<?php
$ch = curl_init('https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'x-api-key: ' . getenv('GAFIAPAY_API_KEY'),
'x-timestamp: ' . round(microtime(true) * 1000),
],
]);
$data = json_decode(curl_exec($ch), true);require 'net/http'
require 'json'
uri = URI('https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1')
req = Net::HTTP::Get.new(uri)
req['x-api-key'] = ENV['GAFIAPAY_API_KEY']
req['x-timestamp'] = (Time.now.to_f * 1000).to_i.to_s
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(req) }
data = JSON.parse(res.body)import java.net.URI;
import java.net.http.*;
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1"))
.header("x-api-key", System.getenv("GAFIAPAY_API_KEY"))
.header("x-timestamp", String.valueOf(System.currentTimeMillis()))
.GET()
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());Troubleshooting
"Invalid API key"
- Check that the key is correct and complete.
- Make sure the key is active in the dashboard.
"Invalid signature"
- Make sure you're using the right secret key.
- Compare your signing code with the examples.
- Check that the timestamp is within 5 minutes of the server's time.