Authentication

Some API requests require some authorisation to either access data or send fund

Authorisation

All APIs that return an error: Unauthorised API access requires you to include the public key in the header.

Invoice Payment API requests only require the public key in the header.

API Keys

Applications keys are what uniquely identifies your merchant account when integrating. Service delivery and issue resolution are all dependent on these keys.

When you create a Qwaap account, you are given two kinds of keys:

1. Public Key: This is a unique identifier of your merchant account. It is required to make every API request to the platform

2. Secret Key: This is a unique identifier of your merchant account. It is required to make every API request to the platform

Generating Keys

If you haven't generated your Application keys already, the button to generate them will display on your account dashboard as soon as you select your merchant account at login.

Retrieving Keys

If you have already generated them:

1. Click Profile from the menu of your account.

2. Go to the Merchant Accounts and you will see your account listed.

3. Select your Account and click the edit (pencil) button.

4. Click the Generate Keys button.

NOTE

We do not display your secret key under your account because we do not store it in plain text. Once you have generated it on request, we encrypt and store only the encrypted version of it. When you later include it in your authenticated API requests, we encrypt the one you send us and compare it with the encrypted version stored on our side.

Regenerating Keys

To re-generate your keys, you will need to go to > Profile > Merchant Accounts > select your merchant account by clicking the edit(pencil icon) button > Click Generate Keys Button

Only the secret key will be re-generated and replaced with the older one. You must copy the newly generated key all the time before clicking the green save button as you will not be able to see it again. You will need to re-generate a new one whenever it's misplaced or compromised since it's used as the API password to your merchant account during API request authentication.