API reference

Authentication

You prove who you are with a secret API key. Send it in the Authorization header of every request.

GET /v1/payments HTTP/1.1
Host: api.tigerpay.app
Authorization: Bearer sk_test_YOUR_KEY

All requests must use HTTPS. There is no other way to authenticate: no query-string keys, no basic auth.

Keys#

Key	What it does
`sk_test_…`	Test mode. Creates test payments. No real money moves. Works as soon as you have an account.
`sk_live_…`	Live mode. Takes real payments. Works only after TigerPay has enabled live payments for your account.

A key belongs to one merchant account. It can only see that merchant's payments and refunds.
A test key only sees test data. A live key only sees live data. A payment made with one key can never be read with the other kind.
Keys are secret keys. TigerPay has no public or publishable keys.
Only the admin of the merchant account can create or revoke keys, in the TigerPay merchant dashboard.
You can have more than one key at a time, and each key has a name. Use one per system or per environment.

Keys are shown once#

The dashboard shows the full key only when you create it. TigerPay stores a one-way hash, not the key itself, so we cannot show it to you again. If you lose a key, revoke it and create a new one.

Rotating a key#

Create a new key.
Put the new key in your server's settings and deploy.
Revoke the old key in the dashboard. Requests that use it then fail with invalid_api_key.

Keep secret keys on your server#

Anyone with your live key can create payments and issue refunds on your account.

Treat it like a password.

Call the API from your server only. Never from browser JavaScript, a mobile app or a desktop app that you give to customers.
Keep keys in environment variables or a secrets manager. Do not write them into source code.
Do not commit keys to git, paste them into chats or tickets, or print them in logs.
If a key may have leaked, revoke it straight away and create a new one.

Webhook secrets are different#

Each webhook endpoint has its own signing secret that starts with whsec_. It is used to check that a webhook really came from TigerPay. It cannot call the API. See Webhooks.

Authentication errors#

Code	What it means
`missing_api_key` HTTP 401	There is no `Authorization: Bearer …` header.
`invalid_api_key` HTTP 401	The key is wrong, badly formed, or has been revoked. All three give the same answer.
`live_mode_not_enabled` HTTP 403	You used a live key but live payments are not enabled for your account yet. Use a test key, or contact TigerPay.
`account_inactive` HTTP 403	The merchant account is not active.

{
  "error": {
    "type": "authentication",
    "code": "invalid_api_key",
    "message": "Invalid API key provided."
  }
}