Authentication
Authenticate your requests with your API key in the Authorization header. Use a private key for sensitive operations, a public key for the rest.
The API uses key-based (token) authentication. You pass your key in the Authorization
header of each request. Wajub accepts the key directly, without the Bearer prefix.
Secret keys (sk...) grant access to all operations; public keys (pk...)
are limited to non-sensitive operations (payment initialization, reading public resources);
restricted keys (rk...) grant access to only the specific resources you scope them to.
https://api.wajub.com/balanceThe three-key model
AuthorizationheaderrequiredThree key types
Secret keys are unrestricted and must never leave your server. Public keys are safe
to expose client-side but limited to non-sensitive operations. Restricted keys let you
issue a key scoped to a subset of resources (e.g. payment.read only) for a specific
integration or third party — create and scope them from Developers → API Keys.
No backend SDK yet
There is no published @wajub/sdk, wajub (PyPI), or Wajub\Wajub (Composer) package —
the JS/Python/PHP/Go tabs below are illustrative only. Use curl or your language's standard
HTTP client instead. See SDKs & Libraries for details.
curl https://api.wajub.com/balance \
-H "Authorization: sk_test.2a7c5e91b0d34f68"Authentication errors
{
"code": 401,
"status": "Unauthorized",
"message": "Invalid API credentials"
}A key that was valid but has since expired returns the same 401 with
"message": "Invalid or revoked API credentials" instead.
401— key missing, malformed, expired or revoked.403— either the key doesn't have the required permission for the requested operation, or the request came from an IP address not on that key's allow-list ("message": "IP address not allowed for this API key").
Protect the secret key
Never include sk… in client-side code (browser, mobile). In case of a leak, revoke the
key from Developers → API Keys: rotation is instant and does not affect your other
keys.
Best practices
- Store keys in environment variables, never in the repository.
- Use separate keys per environment (test vs production).
- Rotate your keys periodically and after any team member departs.