Authentication - StablePay

All API requests require authentication using a Bearer token in the Authorization header.

API Keys

You’ll receive an API key when you register as a partner. API keys look like:

pk_live_a1b2c3d4e5f6g7h8i9j0...

Keep your API key secure. Never expose it in client-side code or public repositories.

Include your API key in the Authorization header:

curl https://api.stablepay.global/v2/users \
  -H "Authorization: Bearer pk_live_your_api_key"

Environment	Base URL	Key Prefix
Production	`https://api.stablepay.global`	`pk_live_`
Sandbox	`https://sandbox-api.stablepay.global`	`pk_sandbox_`

Use sandbox keys for testing. Sandbox transactions don’t result in real payouts.

Authentication errors return 401 Unauthorized:

{
  "error": "Unauthorized",
  "message": "Invalid or missing API key"
}

Rate limit errors return 429 Too Many Requests:

{
  "error": "Rate Limit Exceeded",
  "message": "Too many requests. Please try again later.",
  "retryAfter": 60
}

For additional security, you can whitelist IP addresses in the Dashboard. When enabled, requests from non-whitelisted IPs will be rejected.

Webhooks are signed using HMAC-SHA256. See the Webhooks guide for implementation details.