One key, plus a token if you want one

The API key

Send it as a header on every /api/* request:

X-API-KEY: YOUR_API_KEY

You create keys yourself in the Paytia merchant portal, under the API secret key sub-menu. Pick Single JSON format when you do. Each Paytia account has its own key, so an integration that serves several accounts holds several keys. Step by step: how to add an API key.

A wrong key comes back as 401 Invalid API key. Cookies play no part in this API, so you don't need to carry a session between calls.

Live hosts and test mode

https://accounts.paytia.com and https://accounts.pay729.net are both live production, with no port. There are no separate sandbox keys or sandbox hosts. To test, run your live account with its payment gateway in test mode.

Enhance Security: ACCESS-TOKEN

With Enhance Security switched on, every call needs a second header, ACCESS-TOKEN. Get one by posting the credentials from the portal's Generate Tokens screen to /api/authorize:

curl --request POST \
  'https://accounts.paytia.com/api/authorize' \
  --header 'X-API-KEY: YOUR_API_KEY' \
  --form 'client_id="YOUR_CLIENT_ID"' \
  --form 'client_secret="YOUR_CLIENT_SECRET"'
# optional: --form 'refresh_token="..."'
# returns access_token, refresh_token, expire_time

Send the returned access_token as the ACCESS-TOKEN header, alongside X-API-KEY. The header name matters: ACCESS-TOKEN, with a hyphen. Setting it up in the portal: enhanced API key security.

Keep keys on your server

Your key and token belong in your server's configuration, never in browser code or source control. The try-it explorer on these pages is the one exception: it sends your key to a Paytia-hosted proxy over HTTPS and doesn't store it. In production, every call should start from your backend.

Need a hand?

Write to techsupport@paytia.com, or talk to your Paytia account manager. Not a customer yet? Ask about API access →