Authentication

API keys, allowed IP addresses and environments

Every request carries your secret API key in the Authorization header:

curl https://api.kemypay.com/v1/mobile-money/countries \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

Key	Mode	Money
sk_test_…	Test	None. Every outcome is simulated.
sk_live_…	Live	Real payments from real customers.

Test and live data never mix: a test key only sees test payments and test balances.

Allowed IP addresses

Requests are accepted only from the IP addresses you allowed in your dashboard. Add the public IPs of your servers before your first call. A request from another address is refused with 403 IP_NOT_ALLOWED, even with a valid key.

Never call the API from a mobile app or a browser. Your secret key would be readable by anyone. Your app talks to your server; your server talks to KemyPay.

Base URL

https://api.kemypay.com/v1

Errors

A missing key returns 401 AUTHENTICATION_REQUIRED, a wrong key 401 AUTHENTICATION_FAILED. Too many requests return 429 RATE_LIMIT_EXCEEDED. See Errors.