Ssentezo Developers
Sandbox and production use the same API host. The organization status, SANDBOX or LIVE, is the environment. This portal does not simulate a successful payment when a call fails.

Authentication

Every merchant route expects HTTP Basic authentication.

Authorization: Basic base64(api_user_id:api_key)
Content-Type: application/json

Create the user and key in the signed-in merchant portal under API keys. Keep both in environment variables. Do not put them in browser JavaScript, mobile apps, query strings, or logs.

What the middleware checks

  • Missing header: HTTP 401, NO_AUTHORIZATION_HEADER.
  • Header does not start with Basic : HTTP 403, INVALID_AUTHORIZATION_HEADER.
  • Username or key missing: HTTP 403, MISSING_USER_OR_KEY.
  • Unknown pair: HTTP 403, INVALID_USER_OR_KEY.
  • Suspended organization user: HTTP 403, ORGANIZATION_SUSPENDED.
API records can store allowed_services, a host, and an IP address. The authentication middleware does not currently enforce those fields. Do not treat them as active scopes.

There is no OAuth flow and no per-endpoint permission scope for API clients. The key acts for the organization stored on that credential. If the same owner has another organization, API calls still use the credential's organization. The signed-in merchant website still opens the owner's first organization.

Rotating a key is the regenerate action on the API keys page. The previous key stops matching. Webhook signing uses a different secret, described on the webhooks page. It is not this API key.