Authentication
Every direct Payscribe API request is authenticated with the API key issued in Settings → API Keys. Send it in the Authorization Bearer header from a server you control.
- cURL
- Node.js
- Python
- Go
curl https://sandbox.payscribe.ng/api/v1/my-account/balances \
-H "Authorization: Bearer $PAYSCRIBE_API_KEY"
const response = await fetch('https://sandbox.payscribe.ng/api/v1/my-account/balances', {
method: 'GET',
headers: {Authorization: `Bearer ${process.env.PAYSCRIBE_API_KEY}`},
});
const result = await response.json().catch(() => null);
if (!response.ok) throw new Error(`Payscribe request failed: ${response.status}`);
console.log(result);
import os
import requests
response = requests.get(
'https://sandbox.payscribe.ng/api/v1/my-account/balances',
headers={'Authorization': f"Bearer {os.environ['PAYSCRIBE_API_KEY']}"},
timeout=20,
)
response.raise_for_status()
print(response.json())
package main
import (
"fmt"
"io"
"net/http"
"os"
)
func main() {
var body io.Reader
request, err := http.NewRequest(http.MethodGet, "https://sandbox.payscribe.ng/api/v1/my-account/balances", body)
if err != nil { panic(err) }
request.Header.Set("Authorization", "Bearer "+os.Getenv("PAYSCRIBE_API_KEY"))
response, err := http.DefaultClient.Do(request)
if err != nil { panic(err) }
defer response.Body.Close()
responseBody, _ := io.ReadAll(response.Body)
if response.StatusCode < 200 || response.StatusCode > 299 { panic(fmt.Sprintf("Payscribe request failed: %s", response.Status)) }
fmt.Println(string(responseBody))
}
Credentials and environments
| Credential | Current format | Purpose | Where it belongs |
|---|---|---|---|
| Sandbox API key | ps_pk_test_... | Authenticates sandbox API requests. | Server environment during development and testing. |
| Production API key | ps_pk_live_... | Authenticates production API requests. | Production server environment only. |
| Webhook secret | ps_test_... / ps_live_... | Verifies Payscribe webhook signatures. It does not authenticate API calls. | Server environment, stored separately from the API key. |
Although older dashboard and code paths call it a “public key”, the current API uses this key to authenticate business API operations. Do not place it in browser or mobile code, source control, logs, screenshots, URLs, or support tickets. Keep it on your server and protect it like any credential that can move money.
Sandbox
Use a ps_pk_test_... key with https://sandbox.payscribe.ng/api/v1. Pairing a test key with the production URL, or a live key with the sandbox URL, is an authentication error.
Production API access also enforces the business IP allowlist configured in the dashboard. Add the outbound IP address of the server that sends your API requests before going live.
Next steps
Was this page helpful?