Request authentication
All API requests must include the appropriate API key in the Authorization header:
Authorization: {your_api_key}Requests without a valid API key will receive a 401 Unauthorized response.
API keys
Ansa uses API keys to authorize access to all API endpoints. Keys are scoped by role — either the merchant or the customer — and are environment-specific.
All keys include a prefix to help identify their type and environment:
ansa_sk_live_{identifier} // Live merchant secret key
ansa_sk_sandbox_{identifier} // Sandbox merchant secret key
ansa_cs_live_{identifier} // Live client secret key
ansa_cs_sandbox_{identifier} // Sandbox client secret keyMerchant secret key
Merchant secret keys can be generated in the Ansa Portal by navigating to 'Settings' -> 'API Keys'. Each secret key can only be viewed once after generation.
Many API endpoints can only be invoked with a merchant secret key to authorize access to merchant-scoped functionalities.
Keep merchant secret keys secureMerchant secret keys must remain confidential and should only be used from secure server-side systems. Never transmit or embed a merchant secret key in client-side code.
Client secret key
A client secret key is a short-lived credential that authorizes access to customer-scoped endpoints.
To enable both web and mobile frontends to call Ansa’s APIs directly, your backend cancreate a payment session using the merchant secret key. This operation creates a client secret with a limited time-to-live (TTL) that can safely be stored on the client to access selected APIs.
Merchant publishable key
The merchant publishable key is accessible within Ansa Portal by navigating to 'Settings' -> 'API Keys'. There is a single, static publishable key per environment.
The publishable key is safe to embed in client-side code, such as mobile applications, and can be used to initialize Ansa’s SDKs. It is authorized to interact with a limited set of endpoints that do not require elevated privileges.