Skip to main content

Authentication

API authentication basics and best practices.

The API uses Bearer (Token) Authentication to authenticate any request. These tokens are JSON Web Tokens (JWT) which need to be created server side by your application.

Create an API secret​

To sign a JWT you will need an API secret. In the EFundPay dashboard, the API secret is the merchant RSA private key generated from Developer Tools > API Credentials. Click Generate RSA Credentials to create or rotate it.

Store the API secret with your server code or in a secure environment accessible to your application. Regenerating RSA credentials invalidates the previous merchant RSA private key.

Server-side SDKs​

By far the easiest way to create a JWT is with one of our server-side SDKs.

C#
C# SDK
Make server-side calls with our C# SDK.
Go#
Go SDK
Make server-side calls with our Go SDK.
Java#
Java SDK
Make server-side calls with our Java SDK.
Php#
PHP SDK
Make server-side calls with our PHP SDK.
Python#
Python SDK
Make server-side calls with our Python SDK.
Node.js#
TypeScript SDK
Make server and client-side API calls with our TypeScript SDK.

Development Tools​

  • CLI: Create API tokens and checkout sessions with our command line interface tool.
  • Postman: Start exploring our API using our official Postman collection.

Without SDKs​

It is also possible to generate the JWT without our SDKs using any number of open source JWT libraries.

When calling the payment APIs directly, send the signed JWT as Authorization: Bearer <jwt> and include the x-merchant-account-id header. See JWTs for the required JWT header, claims, scopes, and signature algorithm.

Powered by Docusaurus