Esc

API key setup

Generate an API key and secret key in your dashboard, keep them on your server, and use them to sign requests.

Get your API keys

  1. Log in to your dashboard

    Sign in to your Gafiapay business dashboard.

  2. Open API Settings

    Go to the API Settings section.

  3. Generate a key pair

    Click Generate New API Key to create an API key and a secret key.

  4. Save both keys

    Copy them somewhere secure right away. You can't view the secret key again.

Key format

Your API key is a 64-character string of letters and digits. Your secret key is longer, 128 characters. Neither has a prefix:

API key
3f9a1c2e7b4d0a8f6e5c1b2a9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e

Keep your keys safe

  • Never share them. Don't commit keys to version control or post them anywhere public.
  • Use environment variables or a secure configuration file to store them.
  • Rotate them regularly. Generate new keys, update your applications, then retire the old ones.
Keep the secret key on your server

Anyone with your secret key can sign requests as your business. Never send it to a browser or a mobile app; have your front end call your own backend instead.

Load keys from the environment

Put both keys in a .env file (or your platform's secret store) and read them when you sign a request:

// .env file
GAFIAPAY_API_KEY=sbp_live_1234567890abcdef1234567890abcdef
GAFIAPAY_SECRET_KEY=your_secret_key_here

// Usage in your code
require('dotenv').config();
const apiKey = process.env.GAFIAPAY_API_KEY;
const secretKey = process.env.GAFIAPAY_SECRET_KEY;

// Example API request
const axios = require('axios');

const headers = {
  'x-api-key': apiKey,
  'x-signature': generateSignature(requestBody, timestamp, secretKey),
  'x-timestamp': Date.now(),
  'Content-Type': 'application/json'
};

const response = await axios.post('https://api.gafiapay.com/api/v1/external/account/generate', requestBody, { headers });

Test your key

List one of your virtual accounts. It's read-only, so it's a safe first call. A 200 response means your key works; a 401 tells you what's wrong (see authentication errors).

curl -X GET 'https://api.gafiapay.com/api/v1/external/account/list?page=1&limit=1' \
  -H 'x-api-key: your_api_key' \
  -H 'x-timestamp: 1678901234567'

Troubleshooting

"Invalid API key"

  • Check that the key is correct and complete.
  • Make sure the key is active in the dashboard.

"Invalid signature"

  • Make sure you're using the right secret key.
  • Compare your signing code with the examples.
  • Check that the timestamp is within 5 minutes of the server's time.
GafiaPayGafiaPayDocs
Guide for AI agents Dashboard