Escrow Safe Trade is live: protect your next high-value deal Learn more
ProductsPayment links & checkoutM-Pesa, cards, invoices, split payoutsEscrow Safe TradeMilestone and release-based escrowWallets & P2PPersonal and business walletsChama, Lengo & DeniGroup savings, goals and IOUsBusiness toolkitAccounting, payroll, POS, ticketingBulk payments & payrollPay many people in one uploadSubscriptions & billingRecurring plans and renewalsRent, loans & donationsCollections and campaignsAll products
SolutionsMerchantsBuyersChama groupsBusiness solutionsIndustries
Pricing
DevelopersDeveloper overviewQuickstart, auth and sandboxREST APIsCheckout, invoices and requestsWebhooksSigned, real-time eventsWallet-as-a-ServiceVirtual sub-accountsDocumentationGuides and API reference
Security
CompanyAbout usCareersPartnersBlogHelp centreContact us
Log in Get started Talk to sales
Get started

Authentication

Every server-to-server request carries your business API key in one header. This page shows what a key looks like, where to create it and how to keep it out of harm's way.

Base URLhttps://api.paysasa.com/api/v1Authx-api-keyFormatJSON

Include your composite API key in x-api-key. Format: apk_live_xxx.secret or apk_test_xxx.secret. Generate keys from Businesses → API Keys.

HTTP
POST /checkout/sessions HTTP/1.1
Host: api.paysasa.com
Content-Type: application/json
x-api-key: apk_live_a1b2c3d4.7f9e0a...
Security: Never expose your API key in client-side code or public repositories. Use it only in server-side code or secure environments. Keys can be revoked at any time from your Businesses page.