API keys & credentials

Each application in your Pesepay account (see Onboarding) has two keys:

Key	Used for
Integration key	Sent as the authorization header on every API request
Encryption key	Encrypting requests and decrypting responses — see the Encryption Guide

Sandbox vs live keys

Sandbox and production are separate accounts with separate applications, so you hold two pairs of keys. A pair only works against the environment it was issued for:

Keys from	Base URL they work against
Sandbox	https://api.test.sandbox.pesepay.com/payments-engine/...
Live	https://api.pesepay.com/api/payments-engine/...

Caution

Crossing the two is the most common setup failure, and it doesn’t announce itself clearly. A sandbox integration key sent to production fails authentication — 403, Integration key for the application is not valid — and a mismatched encryption key fails at the cipher instead, giving you a 500 with Failed to decrypt your data or a payload that decrypts into nothing usable. Neither message says “wrong environment”. Before debugging the encryption scheme, confirm that the key and the URL come from the same environment.

Label them unmistakably in your configuration — PESEPAY_SANDBOX_* and PESEPAY_LIVE_* rather than one PESEPAY_KEY that changes meaning per deploy — and never let a sandbox key reach a production build, or the reverse.

Keep requests server-side

Danger

Never call the Pesepay API directly from frontend/browser code. Doing so exposes your integration key and encryption key to anyone who opens your browser’s network tab. All requests to Pesepay must originate from your server, where the keys stay out of reach.

If a key is compromised

Deactivate the affected key from the Merchant Control Panel and issue a new one immediately, then update it everywhere it’s used. There’s no grace period — treat any suspected exposure as urgent.

Rotating keys

Rotating a key changes what your live servers need to encrypt/decrypt with — plan rotations as a deploy, not a dashboard-only change:

1. Generate the new key in the Merchant Control Panel.
2. Deploy your servers with the new key.
3. Confirm new transactions encrypt/decrypt correctly.
4. Deactivate the old key.