Authentication

HesabPay gateway APIs use API-key authentication for merchant server requests.

Authentication Scheme

API Key

Header

Authorization: API-KEY your_api_key

Credentials

Name	Location	Required	Description
Authorization	Header	Yes	API key using the API-KEY prefix.

Example

curl --request POST \
  --url "$HESABPAY_API_URL/api/v1/payment/create-session" \
  --header "Authorization: API-KEY $HESABPAY_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"items":[{"id":"order-1001","name":"Order #1001","price":1200}]}'

API key handling

• Store API keys in server-side environment variables.
• Do not expose API keys in frontend code.
• Rotate keys if they are leaked or no longer needed.
• Use different keys per integration when possible.