Authentication

Overview

ZAFA PAY API uses Bearer Token authentication. All API requests must include an access token in the Authorization header.

Obtaining Access Token

You can obtain an access token from the merchant dashboard.

Open Merchant Settings

Select “Merchant Settings” from the side menu

Get Access Token

Use the access token displayed in the “API Settings” section

API Endpoints

Environment	Base URL	Purpose
Sandbox	`https://api.sandbox.zafapay.com`	Testing & Development
Production	`https://api.zafapay.com`	Production

Different access tokens are required for Sandbox and Production environments.

Authentication Method

Set the Authorization header in all API requests.

cURL

curl https://api.sandbox.zafapay.com/v1/payments \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json"

Node.js

const response = await fetch('https://api.sandbox.zafapay.com/v1/payments', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify(data)
});

Authentication Errors

Error Code	HTTP Status	Cause
`unauthorized`	401	Invalid or expired token
`forbidden`	403	Account is deactivated

Error Response Examples

401 Unauthorized

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid authorization header"
  }
}

403 Forbidden

{
  "error": {
    "code": "forbidden",
    "message": "Merchant account is inactive"
  }
}

Publishable Key (for S2S Payments)

For server-to-server payments, a separate publishable key is used to tokenize card details from the browser.

Key Type	Prefix	Usage	Exposure
Access Token	—	All API operations (server-side)	Never expose to client
Publishable Key	`pk_test_` / `pk_live_`	Token creation only (browser)	Safe to use in frontend code

You can obtain your publishable key from the merchant dashboard under Merchant Settings > API Settings.

Browser

// Publishable key — safe for client-side use
const zafapay = Zafapay('pk_test_xxxxx');
const { token } = await zafapay.createToken({ ... });

Publishable keys can only create tokens. They cannot access payments, customers, or any other API resources.

Security Best Practices

🔒 Store Tokens Securely
Store access tokens in environment variables or secret management services. Never hardcode them in your code. 🛡️ Use HTTPS
Always make API requests over HTTPS. 🖥️ Server-Side Calls
Never expose access tokens in client-side (browser) code. 🔄 Regular Rotation
Regularly regenerate access tokens for security.

Overview

Payments

Customers

Tokens

Webhook

Overview

Obtaining Access Token

API Endpoints

Authentication Method

Authentication Errors

Error Response Examples

Publishable Key (for S2S Payments)

Security Best Practices

​Overview

​Obtaining Access Token

​API Endpoints

​Authentication Method

​Authentication Errors

​Error Response Examples

​Publishable Key (for S2S Payments)

​Security Best Practices

Overview

Obtaining Access Token

API Endpoints

Authentication Method

Authentication Errors

Error Response Examples

Publishable Key (for S2S Payments)

Security Best Practices