API keys

Nexpay authenticates your API requests using API keys. If a request doesn't include a valid key or uses a revoked key, Nexpay returns an Unauthorized error. You manage API keys from the Settings page in the Nexpay Dashboard.

Create an API key

To create an API key:

1. Open the Nexpay Dashboard.
2. Click your avatar in the top-right corner and select Settings.
3. In the API Keys section, click Create API Key.
4. Enter a descriptive label for the key (e.g. "Production Backend", "Staging Integration").
5. Click Create.
6. Copy both the Client ID and Secret immediately.

Using your API key

Include your API key in the Authorization header of every request:

const response = await fetch('https://api.nexpay.com/v2/users/me', {
  method: 'GET',
  headers: {
    'Authorization': 'ApiKey your-api-key-here',
  },
});

See Authentication for more details on how Nexpay authenticates requests.

Revoke an API key

If a key is compromised or no longer needed, revoke it immediately. Any integration using a revoked key will stop working.

To revoke a key:

1. Open the Nexpay Dashboard.
2. Go to Settings.
3. In the API Keys section, hover over the key you want to revoke.
4. Click Revoke.
5. Confirm the revocation in the dialog.

Revoked keys are moved to a Revoked Keys section for reference but cannot be reactivated. Create a new key and update your integration to use it.

Keep your keys safe

Anyone with your API key can make API calls on behalf of your account. Follow these best practices:

• Don't store keys in version control systems.
• Use environment variables or a secrets management service (e.g. AWS Secrets Manager, Google Secret Manager).
• Don't embed keys in client-side code where they could be exposed.
• Rotate keys periodically and revoke unused ones.
• Grant access only to those who need it.