Help Center

Find answers, guides, and resources to help you manage your ZAFA PAY merchant account.

API keys

Applies to:Merchants with API integration

Your API key authenticates requests to the ZAFA PAY API. You can find your key in the Merchant Portal and regenerate it if needed. This article explains how to manage your API key securely.

Find your API key

Your API key is available in the Merchant Settings section of the portal:

  1. 1Log in to the Merchant Portal.
  2. 2Click Merchant Settings in the sidebar menu.
  3. 3On the Profile tab, scroll to the Integration section. Your API key will be displayed here.
  4. 4Click the copy button to copy the key to your clipboard.

Regenerate your API key

If your API key has been compromised or you need a fresh key, you can regenerate it from the portal:

  1. 1Navigate to Merchant SettingsProfile Integration section.
  2. 2Click the Regenerate button next to your API key.
  3. 3A confirmation dialog will appear warning you that the current key will be permanently invalidated. Click Confirm to proceed.
  4. 4Your new API key will be displayed. Copy it immediately and update your integration.

API key security

Your API key is a sensitive credential. Follow these best practices to keep it secure:

  • 1Server-side only: Never expose your API key in client-side code (JavaScript, mobile apps, or browser-accessible files). All API calls should be made from your server.
  • 2Environment variables: Store your API key in environment variables or a secrets manager — not in source code or configuration files.
  • 3Exclude from version control: Add your environment file (e.g., .env) to your .gitignore to prevent accidental commits.
  • 4Rotate regularly: Consider regenerating your API key periodically as a security measure, especially if team members with access have changed.
  • 5Monitor for exposure: If you suspect your key has been compromised, regenerate it immediately and review your recent transaction history for unauthorized activity.

If you believe your API key has been compromised, regenerate it immediately and contact our support team to report the incident.