Request authentication

All API requests must include the appropriate API key in the Authorization header:

Authorization: {your_api_key}

Requests without a valid API key will receive a 401 Unauthorized response.

API keys

Ansa uses API keys to authorize access to all API endpoints. Keys are scoped by role — either the merchant or the customer — and are environment-specific.

All keys include a prefix to help identify their type and environment:

ansa_sk_live_{identifier}       // Live merchant secret key
ansa_sk_sandbox_{identifier}    // Sandbox merchant secret key
ansa_cs_live_{identifier}       // Live client secret key
ansa_cs_sandbox_{identifier}    // Sandbox client secret key

Merchant secret key

Merchant secret keys can be generated in the Ansa Portal by navigating to 'Settings' -> 'API Keys'. Each secret key can only be viewed once after generation.

Many API endpoints can only be invoked with a merchant secret key to authorize access to merchant-scoped functionalities.

❗️
Keep merchant secret keys secure
Merchant secret keys must remain confidential and should only be used from secure server-side systems. Never transmit or embed a merchant secret key in client-side code.

Client secret key

A client secret key is a short-lived credential that authorizes access to customer-scoped endpoints.

To enable both web and mobile frontends to call Ansa’s APIs directly, your backend cancreate a payment session using the merchant secret key. This operation creates a client secret with a limited time-to-live (TTL) that can safely be stored on the client to access selected APIs.

Merchant publishable key

The merchant publishable key is accessible within Ansa Portal by navigating to 'Settings' -> 'API Keys'. There is a single, static publishable key per environment.

The publishable key is safe to embed in client-side code, such as mobile applications, and can be used to initialize Ansa’s SDKs. It is authorized to interact with a limited set of endpoints that do not require elevated privileges.