Skip to navigation
Get Started

Authentication

API keys

All payment endpoints use an x-api-key header. You get two keys from your dashboard:

KeyPurpose
Sandbox key (sk_test_...)Testing — no real money moves
Live key (sk_live_...)Production — real payments
POST /api/v1/payments/collection
x-api-key: sk_test_your_key_here
Content-Type: application/json

Never put your API key in frontend JavaScript, mobile app source code, public repositories, or logs. Always call the Stakaba API from your server.

Getting your API key

  1. Sign in to app.stakaba.com
  2. Go to Settings → API Keys
  3. Copy your sandbox key to start testing
  4. After go-live approval, your live key will be available in the same place

Rotating keys

If a key is compromised, rotate it immediately:

POST /api/v1/merchants/me/keys/rotate

This invalidates the old key and issues a new one instantly.

Sandbox vs live

The same API handles both. The key you send determines which mode runs:

  • Sandbox key → simulated payments, no charges to anyone
  • Live key → real money moves, requires an approved merchant account

Test thoroughly in sandbox before switching to live.