Developers
REST API
GuidesErrorsLogin
Get API Keys
API Navigation
  • Overview
  • Quick start
  • Authentication
  • Collect a payment
  • Payment status
  • Refunds
  • Testing
  • Production
  • Security
API reference
  • Create API keys POST
  • List API keys GET
  • Get API key GET
  • Delete API key DEL
  • Collect with MTN POST
  • MTN payment status GET
  • Collect with Airtel POST
    Create and pay
  • Create order POST
  • Order fee POST
  • Pay order with card POST
  • Pay order with bank POST
    • Status and verify
  • Order status POST
  • Verify order POST
    • Cards and tokens
  • Save card POST
  • Tokenize charge GET
    • Refunds
  • Refund order POST
    • Lists and stats
  • List orders GET
  • Get order GET
  • List banks GET
  • Order stats GET
  • List transactions GET
  • Get transaction GET
  • Transaction statuses GET
Errors and limits
  1. Docs
  3. API reference
  5. Create API keys

Create API keys

Generate an API key and secret pair used to authenticate server-to-server requests for the MTN developer route. In Ziba Pay, API keys are managed and configured as gateway configs (gatewayConfigs).

OpenAPI SpecRun in Postman
POST/developer/gatewayConfigsAPI
Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)
Security requirement: 403 CSRF Protection
Auth guide →

Direct server-to-server calls authenticated via Bearer tokens do not require CSRF headers. If you instead invoke mutation endpoints from a web browser using cookie-based sessions, you must include the following header:

X-Requested-With: XMLHttpRequest

Request body

FieldTypeRequiredDescription
namestringRequiredHuman-readable label for this API key pair (e.g., 'Production Webhook Server', 'Mobile App Checkout').
descriptionstringRequiredSystem, service, or environment using this key.
import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/developer/gatewayConfigs";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
    "Content-Type": "application/json",
};

const payload = {
  "name": "Production Store Checkout",
  "description": "Server-to-server payment collections for online ecommerce store"
};

try {
  const response = await axios.post(url, payload, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}
Auth guide
One-Time Secret Notice · apiSecret

The apiSecret is returned only once in plaintext upon creation. Ziba Pay stores only a one-way cryptographic hash. Copy and save this secret immediately in a secure vault or environment variables. It cannot be recovered or retrieved again later through list or get endpoints.

Response fields

FieldTypePresenceDescription
idstringAlways returnedUnique identifier for this gateway configuration. Required when revoking the key via DELETE.
apiKeystringAlways returnedPublic API key identifier. Pass this in the x-api-key HTTP header.
apiSecretstringAlways returnedOne-time plaintext secret. Returned only on creation. Pass this in the x-api-secret header. Stored as an irreversible hash.
namestringAlways returnedDescriptive label provided during creation.
descriptionstringAlways returnedEnvironment or system description provided during creation.
userIdstringAlways returnedMerchant user ID owning this API credential.
createdAtstringOptionalISO 8601 creation timestamp.

Status codes

HTTP StatusMeaning
201API key and secret generated successfully.
400Name or description missing. Body is { status: "fail", message }.
401No merchant session. Missing or expired Bearer token.

Notes

  • Terminology: An API key in Ziba Pay is a gateway config object (`gatewayConfig`). Creating this resource generates the API key and secret pair.
  • Authentication scope: Server-to-server API calls authenticate with Bearer tokens or API keys. Browser-based requests using session cookies require X-Requested-With.
  • Who uses this: Backend services initiating automated payments.
  • When to use (gateway section): Use this key pair in x-api-key and x-api-secret headers when calling POST /payment/gateway-momo-pay. Prefer the Bearer production collect route for published samples.
  • Authentication: x-api-key + x-api-secret on the gateway collect route (/payment/gateway-momo-pay; legacy alias /payment/dev-momo-pay). Prefer the production Bearer route (/payment/mtn-momo-pay) for documented samples. Both auth styles are intentional.

Related

List API keysCollect with MTN
Was this page helpful?

Let us know how we can make our API documentation better.

PreviousSecurity
NextList API keys