Authentication

Hashpay has three authentication styles: an api-key header for transaction endpoints, merchant JWT for the dashboard, and an order-scoped key for hosted checkout.

api-key header (transaction endpoints)

Server-to-server calls to order, rate, QR, and token endpoints use your secret key in the api-key header.

Header

curl -X POST "https://api.hashpay.id/v2/mainnet/merchant/fiat/order" \
  -H "api-key: $HASHPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "merchant_id": "10001", "order_no": "INV-2026-0001", "amount": "150000" }'

Merchant JWT (dashboard & management)

Profile, dashboard, disbursement, payment-link, and webhook-config endpoints use Authorization: Bearer <access_token> obtained from POST /v2/auth/login.

Endpoint	Auth
`/orderLimits`, `/merchant/fiat/order`, `/checkOrderRate`, `/pgqr/fiat/create`, `/listToken`, `/merchant/settlement`	`api-key` header
`/merchant`, `/merchant/dashboard`, `/merchant/transaction`	Merchant JWT
`/merchant/disbursement`, `/merchant/payment-link`	Merchant JWT
`/rate`, `/faucet`, `/order/payment-link`	Public

Order-scoped key (hosted checkout)

The hosted payment page uses a short-lived, order-scoped key (pl_…, TTL 30 minutes) embedded in the checkout url. Never expose your real secret key in a client.