Authentication

PayzCore uses key-based authentication for all API requests. There are two authentication methods, each scoped to a different part of the system.

Authentication Methods

Project API Key (x-api-key)

This is the primary authentication method. Every project gets a unique API key when created. Use it to authenticate all payment-related API calls.

curl -X POST https://api.payzcore.com/api/v1/payments \
  -H "x-api-key: pk_live_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"amount": 50, "chain": "TRC20", "external_ref": "customer-1"}'

The API key identifies which project the request belongs to. All data is scoped to that project — you can only see and manage payments created under the same API key.

Endpoints authenticated with x-api-key:

Master Key (x-master-key)

The Master Key is used for administrative project management. It is not tied to any specific project — it grants access to create and list all projects.

curl -X POST https://api.payzcore.com/api/v1/projects \
  -H "x-master-key: mk_your_master_key" \
  -H "Content-Type: application/json" \
  -d '{"name": "New Store", "webhook_url": "https://example.com/webhook"}'

Endpoints authenticated with x-master-key:

This key should only be used in server-to-server contexts. Never expose it in client-side code.

Getting Your Credentials

When you create a project (via the dashboard or Master Key API), three credentials are generated and displayed once:

How to create a project

1. Log in to the dashboard at app.payzcore.com
2. Navigate to Projects in the sidebar
3. Click Create Project
4. Fill in the project name, webhook URL, and select your wallet
5. On the success screen, copy all three credentials immediately

These credentials are shown only once. They are not stored in a recoverable format. If you navigate away without saving them, you will need to regenerate.

Credential Security

Store credentials in environment variables

Never hardcode credentials in your source code. Use environment variables:

# .env (server-side only)
PAYZCORE_API_KEY=pk_live_abc123def456
PAYZCORE_API_SECRET=sk_live_xyz789
PAYZCORE_WEBHOOK_SECRET=whsec_abc123

// In your server code
const apiKey = process.env.PAYZCORE_API_KEY;

Never expose credentials client-side

API keys and secrets must only be used in server-side code. Never include them in:

• Frontend JavaScript bundles
• Mobile app source code
• Public repositories
• Browser-accessible configuration files
• Client-side API calls

Rotate credentials if compromised

If you suspect a credential has been exposed:

1. Go to Projects in the dashboard
2. Open the affected project
3. Click Regenerate Keys (admin only)
4. All three credentials (API Key, API Secret, Webhook Secret) are regenerated together
5. Update your server configuration with the new values immediately

The old credentials stop working as soon as regeneration is complete. There is no grace period.

Regenerating Keys

Key regeneration resets all three credentials at once. You cannot regenerate them individually.

Who can regenerate:

• Admin users can regenerate keys for any project
• Owner users cannot regenerate keys (contact your admin)

What happens:

1. A new API Key (pk_live_...), API Secret (sk_live_...), and Webhook Secret (whsec_...) are generated
2. The old credentials are invalidated immediately
3. The new credentials are displayed in a dialog — save them before closing
4. Any API calls using the old key will return 401 Invalid API key
5. Any webhooks signed with the old secret will fail signature verification on your end

Rate Limiting

Every API key is subject to two layers of rate limiting:

Burst rate limit

Each API key is limited to 60 requests per minute. This protects against accidental loops or runaway scripts.

When exceeded, the API returns 429 Too Many Requests with these headers:

Daily plan limit

API calls also count against your plan's daily limit (500/day for Free, 25,000/day for Pro). When the daily limit is exceeded, the response includes:

See Rate Limits & Plans for full details on plan limits and daily counters.

Error Responses

Health Check

The health endpoint requires no authentication:

curl https://api.payzcore.com/api/health

It returns the system health status and uptime. Use it to verify that the API is operational.