Authentication

NahuPay uses API keys to authenticate every request. Your key is associated with a specific merchant account and all operations are scoped to that account.

API keys

Find your API keys under Dashboard → Settings → API Keys. Each account has two key pairs:

Key	Prefix	Purpose
Secret key	`test_sk_ / live_sk_`	Server-side API calls — never expose in client code
Publishable key	`test_pk_ / live_pk_`	Client-side use only (e.g. Checkout.js)

Test vs live keys

Both key types share identical APIs. The only difference is what happens to the money:

Test keys — no real money moves; use our test phone numbers to simulate different outcomes.
Live keys — process real payments; require completed KYB verification.

Using your key

Pass the secret key as a Bearer token in the Authorization header:

curl https://api.nahupay.com/v1/payments \
  -H "Authorization: Bearer test_sk_abc123def456" \
  -H "Content-Type: application/json"

In the SDKs, pass the key once at initialisation:

// Node.jsimport NahuPay from 'nahupay';const client = new NahuPay({ apiKey: process.env.NAHUPAY_SECRET_KEY });# Pythonimport nahupaynahupay.api_key = os.environ["NAHUPAY_SECRET_KEY"]

Rotating keys

You can generate a new key from the dashboard at any time. When you rotate a key, the old key continues to work for 15 minutes to give you time to deploy the new value without downtime. After 15 minutes the old key is permanently invalidated.

⚠Rotating a live key will break any integration still using the old key after the 15-minute grace period. Coordinate deployments accordingly.

Security tips

Store keys in environment variables or a secrets manager — never hard-code them.
Add keys to .gitignore / .env and ensure .env is never committed.
Use test keys during local development.
Set up IP allowlisting in the dashboard to restrict which servers can use a live key.
Rotate keys immediately if you suspect they have been compromised.