API keys
Every request to Payofy is authenticated with a secret API key, sent in the Authorization header:
curl https://api.payofy.si/v1/merchants/{id} \
-H "Authorization: Bearer $PAYOFY_SECRET_KEY"
Test and live keys
| Prefix | Use it for | Moves real money? |
|---|---|---|
pfy_test_ | Building and testing your integration | No |
pfy_live_ | Real customers | Yes |
Build everything with a test key first. Switch to a live key only when your integration is ready.
Keeping keys safe
- Server only. Call Payofy from your backend. Never put a key in a website, a mobile app, or any code a customer can download.
- Environment variables. Load the key from an environment variable such as
PAYOFY_SECRET_KEY. Don't write it into source code. - Not in Git. Never commit a key to a repository, public or private.
- Rotate if exposed. If a key may have leaked, ask Payofy to revoke it and issue a new one straight away.
Getting a key
During the preview, Payofy issues test keys to partners directly. Contact your Payofy representative.
tip
The API reference has a Try it console that accepts test keys only. Your key stays in that browser tab and is sent only to the Payofy server you pick.