IZZIPAYDocumentation

Authentication

IZZIPAY uses API keys and JWT tokens to authenticate requests. All API requests must include a valid authentication header.

API Key Types

TEST

Test Keys

Prefix: sk_test_ and pk_test_

Use test keys in your sandbox environment. No real transactions are processed.

LIVE

Live Keys

Prefix: sk_live_ and pk_live_

Live keys process real transactions. Keep these secret and never expose them in client-side code.

JWT Authentication Flow

1

Request a token

POST to /v1/auth/token with your API key

2

Receive JWT token

Token is valid for 1 hour with a refresh token for renewal

3

Use Bearer token

Include in Authorization header for all subsequent requests

Token Request

bash
curl -X POST https://api.izzipay.com/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "sk_test_your_key",
    "grant_type": "api_key"
  }'

# Response
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "rt_abc123..."
}

Token Refresh

When your access token expires, use the refresh token to get a new one without re-authenticating:

bash
curl -X POST https://api.izzipay.com/v1/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{
    "refresh_token": "rt_abc123...",
    "grant_type": "refresh_token"
  }'

Security Best Practices

  • •Never expose secret keys in client-side code or version control
  • •Rotate your API keys regularly through the dashboard
  • •Use environment variables to store keys in your application
  • •Implement IP whitelisting for production environments
  • •Use webhook signature verification to validate incoming events