Authentication & API keys
Authenticate every server-to-server request with a Bearer secret key over HTTPS. A key belongs to one business and one mode.
Key prefixes and environments
Every rafiqPay account has two isolated environments: Test mode and Live mode. Keys carry an explicit prefix so you and automated scanners can tell its mode and capability at a glance:
A secret key (rp_test_sk_... or rp_live_sk_...) is for your servers. Never put it in a browser or a mobile app. A test key only ever reaches test money, and a live key only live money: a request that names the other mode is refused.
curl https://api.rafiqpay.net/v1/balances/summary \
-H "Authorization: Bearer rp_test_sk_kanzu_9f8a7b6c5d4e3f2a"| Parameter | Type | Requirement | Description |
|---|---|---|---|
| rp_test_sk_* | secret key (test) | Required | Server-side test secret key. Available immediately at KYB Tier 1. |
| rp_live_sk_* | secret key (live) | Required | Server-side live secret key. Issued after KYB Tier 2 approval and shown only once at creation. |
What a key can and cannot do
A key can create and read payments, checkout sessions, payment links, customers and billing, and read balances, payouts and reports. It runs as the business, with no person behind it.
A key cannot pay out, refund, approve anything, or change settings, the team, keys or webhooks. Those need a signed-in person, so a leaked key cannot empty a balance. A request outside a key's reach is answered 403.
A key that is wrong, revoked, or malformed is answered 401. Each key may make 600 requests a minute, and is answered 429 above that. A live key needs a business that has passed verification.
Rolling a key