Authentication

All API requests (except account creation) require authentication. Pass your API key in the Authorization header as a Bearer token. Some endpoints also accept api_key in the query string or JSON body for compatibility. API access is blocked until your account email is verified. Transaction-initiation endpoints (STK Push, B2C, B2Pochi) additionally enforce per-key service scopes; ensure the required service is enabled on your key in the dashboard.

Using Bearer Token

Include your API key in the Authorization header:

Authorization: Bearer sk_live_abc123xyz...

Obtaining Your API Key

API keys can be generated from your SwiftWallet dashboard at /api_keys.php

Security Best Practices

• Never expose your API key in client-side code
• Rotate keys periodically for enhanced security
• Verify your email address to activate API access
• Use test keys for development environments
• STK Push requires the stk_push service enabled on your key
• B2C requires the b2c_payments service enabled on your key
• B2Pochi requires the b2pochi_payments service enabled on your key
• Reversals inherit scope from the original transaction (b2c_payments, b2pochi_payments, or b2b_payments)