Authentication

The WasaaPay Partner API uses API keys to authenticate requests. You can manage your API keys from the dashboard.

API Key Authentication

All API requests must include your API key in the X-API-Key header:

curl https://api.wasaapay.com/api/v1/partner/users \
  -H "X-API-Key: sk_sandbox_abc123xyz"

API Key Types

Required Headers

Every API request must include these headers:

Idempotency

All POST requests require an X-Idempotency-Key header. This prevents duplicate operations if you retry a request due to network issues.

// Generate a unique idempotency key for each operation
const idempotencyKey = `transfer_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;

const response = await fetch('https://api.wasaapay.com/api/v1/partner/transfers', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': 'sk_sandbox_abc123xyz',
    'X-Idempotency-Key': idempotencyKey,
  },
  body: JSON.stringify({
    // ... request body
  }),
});

If you send the same idempotency key twice, you'll receive the same response without creating a duplicate transaction.

Rate Limiting

API requests are rate limited to protect the service. Current limits:

Rate limit information is included in response headers:

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 118
X-RateLimit-Reset: 1705312800

IP Whitelisting

For production environments, you can restrict API access to specific IP addresses. Configure this in your dashboard under Partner Settings.

Error Responses

Authentication errors return appropriate HTTP status codes: