API keys
Applies to:Merchants with API integration
Your API key authenticates requests to the ZAFA PAY API. You can find your key in the Merchant Portal and regenerate it if needed. This article explains how to manage your API key securely.
Find your API key
Your API key is available in the Merchant Settings section of the portal:
- 1Log in to the Merchant Portal.
- 2Click Merchant Settings in the sidebar menu.
- 3On the Profile tab, scroll to the Integration section. Your API key will be displayed here.
- 4Click the copy button to copy the key to your clipboard.
Note
Your API key has different prefixes for test mode and production mode. Make sure you are using the correct key for your environment.
Regenerate your API key
If your API key has been compromised or you need a fresh key, you can regenerate it from the portal:
- 1Navigate to Merchant Settings → Profile → Integration section.
- 2Click the Regenerate button next to your API key.
- 3A confirmation dialog will appear warning you that the current key will be permanently invalidated. Click Confirm to proceed.
- 4Your new API key will be displayed. Copy it immediately and update your integration.
Important
Regenerating your API key immediately invalidates the previous key. Any integrations using the old key will stop working until updated. Make sure to update your server configuration right away.
API key security
Your API key is a sensitive credential. Follow these best practices to keep it secure:
- 1Server-side only: Never expose your API key in client-side code (JavaScript, mobile apps, or browser-accessible files). All API calls should be made from your server.
- 2Environment variables: Store your API key in environment variables or a secrets manager — not in source code or configuration files.
- 3Exclude from version control: Add your environment file (e.g.,
.env) to your.gitignoreto prevent accidental commits. - 4Rotate regularly: Consider regenerating your API key periodically as a security measure, especially if team members with access have changed.
- 5Monitor for exposure: If you suspect your key has been compromised, regenerate it immediately and review your recent transaction history for unauthorized activity.
If you believe your API key has been compromised, regenerate it immediately and contact our support team to report the incident.