List API keys

GET/developer/allAPI

Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)

Security requirement: 403 CSRF Protection

Direct server-to-server calls authenticated via Bearer tokens do not require CSRF headers. If you instead invoke mutation endpoints from a web browser using cookie-based sessions, you must include the following header:

X-Requested-With: XMLHttpRequest

import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/developer/all";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
};

try {
  const response = await axios.get(url, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}

Auth guide

Response fields

Field	Type	Presence	Description
`[].id`	string	Always returned	Gateway configuration ID. Used to identify keys for deletion.
`[].apiKey`	string	Always returned	Public API key identifier.
`[].name`	string	Always returned	Descriptive label assigned to this key.
`[].description`	string	Always returned	Environment or usage description.
`[].userId`	string	Always returned	Merchant account ID.
`[].createdAt`	string	Optional	ISO 8601 timestamp when the key was created.

Status codes

HTTP Status	Meaning
200	Array of API key configs without plaintext secrets.
401	No merchant session. Missing or expired Bearer token.

Notes

Security Notice: apiSecret is strictly omitted from list responses. If a secret is lost, you must create a new API key pair.

GET/developer/allAPI

Authentication:Bearer token•Authorization: Bearer <token>(Bearer token for server-to-server API calls)

Security requirement: 403 CSRF Protection

Auth guide →

X-Requested-With: XMLHttpRequest

import axios from "axios";

const url = "https://payment-service-mh2d.onrender.com/api/developer/all";

const headers = {
    Authorization: `Bearer ${process.env.ZIBA_TOKEN}`,
};

try {
  const response = await axios.get(url, {
    headers,
    timeout: 15000,
  });
  console.log("Success:", response.status, response.data);
} catch (error) {
  console.error("Request failed:", error.response?.data || error.message);
}

Auth guide

Response fields

Field	Type	Presence	Description
`[].id`	string	Always returned	Gateway configuration ID. Used to identify keys for deletion.
`[].apiKey`	string	Always returned	Public API key identifier.
`[].name`	string	Always returned	Descriptive label assigned to this key.
`[].description`	string	Always returned	Environment or usage description.
`[].userId`	string	Always returned	Merchant account ID.
`[].createdAt`	string	Optional	ISO 8601 timestamp when the key was created.

Status codes

HTTP Status	Meaning
200	Array of API key configs without plaintext secrets.
401	No merchant session. Missing or expired Bearer token.

Notes

Security Notice: apiSecret is strictly omitted from list responses. If a secret is lost, you must create a new API key pair.

Response fields

Status codes

Notes

Related

List API keys

Response fields

Status codes

Notes

Related