Paymish Loading Docs Preparing guides, collections, and live API references...
Paymish Docs

Authentication

Topics

API Keys

Authentication

Authenticate every Paymish request with your secret key

The Paymish API uses API keys for server-to-server authentication. Your secret key can create or read sensitive data, so it should only live on trusted backend infrastructure.

  • Auth method: Bearer token in the Authorization header
  • Where to get keys: Paymish Dashboard
  • Recommended usage: Backend services, workers, and secure webhook consumers

Test keys

Use pk_test_ and sk_test_ during development. They simulate production behavior without moving real money.

Live keys

Use pk_live_ and sk_live_ only in production environments that are locked down and monitored.

Making Requests

Send your secret key as a Bearer token on every request. Do not send it from browser code or mobile apps.

Recommended: store your secret key in an environment variable such as PAYMISH_SECRET_KEY.
Python
import os
import requests

headers = {
    "Authorization": f"Bearer {os.environ['PAYMISH_SECRET_KEY']}",
    "Content-Type": "application/json",
}

response = requests.get(
    "https://api.paymish.com/api/user-service/external/v1/profile",
    headers=headers,
)

print(response.json())
Node.js
const axios = require("axios");

const response = await axios.get(
  "https://api.paymish.com/api/user-service/external/v1/profile",
  {
    headers: {
      Authorization: `Bearer ${process.env.PAYMISH_SECRET_KEY}`,
      "Content-Type": "application/json",
    },
  }
);

console.log(response.data);
cURL
curl https://api.paymish.com/api/user-service/external/v1/profile \
  -H "Authorization: Bearer $PAYMISH_SECRET_KEY" \
  -H "Content-Type: application/json"
PHP
<?php
$secretKey = getenv("PAYMISH_SECRET_KEY");

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://api.paymish.com/api/user-service/external/v1/profile");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer $secretKey",
    "Content-Type: application/json",
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;

Environments

Sandbox and development

Use test credentials while integrating locally, in staging, or when validating webhook flows.

Production

Switch to live credentials only after your webhook endpoint, error handling, and retries are production-ready.

Important: never reuse live keys in test environments, even temporarily.

Security Best Practices

  • Keep secret keys in environment variables, not committed source files.
  • Never expose secret keys in browser code, mobile binaries, or public repositories.
  • Rotate keys immediately if you suspect accidental exposure.
  • Restrict dashboard access so only the right team members can issue or replace credentials.
  • Review the webhooks guide before handling production notifications.