Authorization

This page describes how to authenticate your server to Plexy Pay’s HTTP API. Authentication is API-key–based and sent in the Authorization header.

Overview

Auth scheme: API Key

Header: Authorization: <api-key>

Transport: HTTPS only (TLS 1.2+)

Who uses it: Your backend (never expose keys in client-side code/apps)

Sending the API Key

Include your key in the Authorization header on every request:

Authorization: <api-key>

Best Practices

Do not prepend Bearer — only use the plain API key string.

Store keys securely: environment variables + secret managers (e.g., Vault, AWS Secrets Manager).

Never embed in front-end/mobile code or logs. Mask keys (********) in any output.

Rotate regularly: support multiple active keys during rotation.

Least privilege: use separate keys per system/environment (prod, stage) and per application.

Protect at rest: disable shell history logging of commands containing keys; prefer .netrc/env var injection.

Respond to compromise: revoke the key immediately and rotate credentials; audit recent calls.

Do not prefix your key with Bearer . The header must contain only the raw API key value, for example:

Authorization: ********************

Example API Method

GET /v1/transactions/by-payment-link/{payment_link_id}

Retrieve a transaction by its payment link identifier.

Auth: Authorization: <api-key> (⚠️ not Bearer)

Method: GET

Path Params:

payment_link_id — UUID

cURL

Responses

200 OK — transaction payload (see example above)

401 Unauthorized — missing/invalid API key

404 Not Found — not found or out of scope

Authorization

Overview#

Sending the API Key#

Best Practices#

Example API Method#

Overview

Sending the API Key

Best Practices

Example API Method