Authentication

Every request (except public tracking) is authenticated with an API key, passed as a bearer token:

Authorization: Bearer SB_51H8f2K9pLxxxxxxxxxxxxxxxxxxxxxxxx

Getting a key

A sandbox key is generated automatically once you verify your email and complete onboarding, no manual step required. You can view and manage all your keys, and generate a production key once approved, from the merchant dashboard under API Keys. A key is shown to you exactly once at creation time and cannot be retrieved again afterward, only revoked and replaced. We never email you a raw key.

Key prefixes and environment

A key's prefix tells you, and us, which environment it belongs to:

The environment a request runs in is resolved entirely from the key itself, never from the URL or any request parameter. This means the exact same endpoint paths serve both environments; you switch environments purely by swapping which key you send. There is no way to use an SB_ key to touch production data, or a PROD_ key to touch sandbox data, even if you tried to force it, the key's stored environment always wins.

Production access

PROD_ keys only work once your business verification (KYB) has been approved and your account has been granted go-live access. Until then, production requests are rejected with a permission_error. Sandbox keys work immediately after signup with no approval needed, and your sandbox wallet is pre-funded with ₦500,000 in mock balance so you can build and test your integration end-to-end before going live.

Revoking a key

If a key is compromised, revoke it immediately from the dashboard. Revocation takes effect on the very next request, there is no caching or propagation delay.