AuthenticationCopy Anchor Link

PayzCore uses key-based authentication for all API requests. There are two authentication methods, each scoped to a different part of the system.

Authentication MethodsCopy Anchor Link

Project API Key (x-api-key)Copy Anchor Link

This is the primary authentication method. Every project gets a unique API key when created. Use it to authenticate all payment-related API calls.

curl -X POST https://api.payzcore.com/v1/payments \
  -H "x-api-key: pk_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"amount": 50, "network": "TRC20", "external_ref": "customer-1"}'

The API key identifies which project the request belongs to. All data is scoped to that project — you can only see and manage payments created under the same API key.

Endpoints authenticated with x-api-key:

Master Key (x-master-key)Copy Anchor Link

The Master Key is used for administrative project management. It is not tied to any specific project — it grants access to create and list all projects.

curl -X POST https://api.payzcore.com/v1/projects \
  -H "x-master-key: mk_your_master_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "New Store", "slug": "new-store", "webhook_url": "https://example.com/webhook", "owner_email": "[email protected]"}'

Endpoints authenticated with x-master-key:

slug is required (lowercase letters, numbers and hyphens). owner_email should be the email of an existing, active PayzCore account: that account becomes the project owner. API keys only authenticate for projects that have an owner, so a project created without owner_email cannot be used (the response then includes a warning). The response (HTTP 201) contains api_key and webhook_secret; store them right away, they are not shown again. GET /v1/projects only returns an api_key_prefix, never the full key.

This key should only be used in server-to-server contexts. Never expose it in client-side code.

Getting Your CredentialsCopy Anchor Link

When you create a project in the dashboard, three credentials are generated and displayed once (the Master Key API returns only the API Key and Webhook Secret):

How to create a projectCopy Anchor Link

1. Log in to the dashboard at app.payzcore.com
2. Navigate to Projects in the sidebar
3. Click Create Project
4. Fill in the project name, webhook URL, and select your wallet
5. On the success screen, copy all three credentials immediately

These credentials are shown only once. They are not stored in a recoverable format. If you navigate away without saving them, you will need to regenerate.

Credential SecurityCopy Anchor Link

Store credentials in environment variablesCopy Anchor Link

Never hardcode credentials in your source code. Use environment variables:

# .env (server-side only)
PAYZCORE_API_KEY=pk_live_abc123def456
PAYZCORE_API_SECRET=sk_live_xyz789
PAYZCORE_WEBHOOK_SECRET=whsec_abc123

// In your server code
const apiKey = process.env.PAYZCORE_API_KEY;

Never expose credentials client-sideCopy Anchor Link

API keys and secrets must only be used in server-side code. Never include them in:

• Frontend JavaScript bundles
• Mobile app source code
• Public repositories
• Browser-accessible configuration files
• Client-side API calls

Rotate credentials if compromisedCopy Anchor Link

If you suspect a credential has been exposed:

1. Go to Projects in the dashboard
2. Open the affected project
3. Click Regenerate Keys (requires Protection Key)
4. All three credentials (API Key, API Secret, Webhook Secret) are regenerated together
5. Update your server configuration with the new values immediately

The old credentials stop working as soon as regeneration is complete. There is no grace period.

Regenerating KeysCopy Anchor Link

Key regeneration resets all three credentials at once. You cannot regenerate them individually. A Protection Key (WPK) is required.

Who can regenerate:

• Project owners can regenerate keys for their own projects
• A security alert email is sent when keys are regenerated

Dashboard PermissionsCopy Anchor Link

These permissions apply to your PayzCore dashboard account.

What happens when you regenerate:

1. A new API Key (pk_live_...), API Secret (sk_live_...), and Webhook Secret (whsec_...) are generated
2. The old credentials are invalidated immediately
3. The new credentials are displayed in a dialog — save them before closing
4. Any API calls using the old key will return 401 Invalid API key
5. Any webhooks signed with the old secret will fail signature verification on your end

Rate LimitingCopy Anchor Link

Every API key is subject to two layers of rate limiting:

Burst rate limitCopy Anchor Link

Each API key is limited to 60 requests per minute. This protects against accidental loops or runaway scripts.

When exceeded, the API returns 429 Too Many Requests with these headers:

Daily plan limitCopy Anchor Link

API calls also count against your plan's daily limit (500/day for Free, 5,000/day for Pro). When the daily limit is exceeded, the response includes:

See Rate Limits & Plans for full details on plan limits and daily counters.

Error ResponsesCopy Anchor Link

Health CheckCopy Anchor Link

The health endpoint requires no authentication:

curl https://api.payzcore.com/health

It returns the system health status and uptime. Use it to verify that the API is operational.