Get your API keys
Every request to the Paga API is authenticated with three credentials from your Paga Business dashboard. Sandbox and Live each have their own set.
Your keys work once your account is approved. Sandbox accounts are approved within 24 hours of your request. Live accounts are approved after business verification (KYC). See Get started if you haven’t set up an account yet.
Your three credentials
You’ll see these names used in different places across the docs and libraries. They all refer to the same three values.
principalTells Paga which business account is making the request.credentialsProves the request really comes from you. Never expose it in client-side code.hashUsed to generate the request hash for APIs that need one. See Hashing.Find your keys
Log in to the dashboard for your environment
Open Developer Tools
Select Developer Tools in the dashboard menu.
Select API Keys
Your public key, secret key and hash key are shown here. Copy them into your server’s environment variables.
Use your keys
Send your keys as request headers. Each API page lists the exact headers it needs, and Authentication explains the full flow.
principal: YOUR_PUBLIC_KEY
credentials: YOUR_SECRET_KEY
hash: HASH_GENERATED_WITH_YOUR_HASH_KEYKeep your keys safe
Treat your secret key and hash key like passwords
- Store them in environment variables or a secrets manager, never in source control.
- Only use them on your server, never in browser or mobile app code.
- Sandbox and Live keys are different. Keys from one environment won’t work in the other.
- If you think a key has been exposed, log in to your business portal and reset it in Developer Tools → API Keys straight away, then update it on your server.
Need help? We’re here 24/7
Talk to our support team any time, or ask questions in the developer community.
Updated 2 days ago