Authentication

Shop API key and the X-Api-Key header

Getting a key

API keys are issued in the dashboard: open the card of an active shop and click "Issue key". The key starts with tp_ and is shown only once - we store only its fingerprint. If you lose the key, reissue it: the old one stops working immediately.

Sending the key

Include the X-Api-Key header in every request:

Header

curl https://tabpay.org/api/v1/payments/6b9d2c88-4b1a-4f0e-9c37-1f2ab34cd561 \
  -H "X-Api-Key: tp_your_key"

On any authorization failure - a missing or invalid key, an inactive shop - the API responds with the same 401 without disclosing the reason:

Response 401

{
  "statusCode": 401,
  "message": "Неверный API-ключ",
  "error": "Unauthorized"
}

Storing the key

the key grants full access to the shop's API: payments and cancellations, the account balance, subscriptions; keep it in application secrets, not in code or the repository;
never use the key in a browser or a mobile app - server side only;
at the slightest suspicion of a leak, reissue the key in the dashboard.