WakaPay Docs

Authentication & authorization

The WakaPay Aggregator exposes a mix of public endpoints (e.g. customer-facing checkout interactions) and protected endpoints (merchant/admin operations).

Bearer tokens (JWT)

When an endpoint requires auth, send an Authorization header:

Authorization: Bearer <token>

Security best practices

  • Keep API keys/tokens on the server. Avoid putting credentials in browser code or mobile apps.
  • Use short-lived tokens and rotate secrets regularly.
  • Log request IDs and relevant references (session ID, invoice ID) for debugging/support.

For exact auth requirements per endpoint, see API Reference (each endpoint is labeled Public/Auth when possible).