Your API Keys

Loading API keys…

Quick start

Full docs

Send your API key in the Authorization header of every request: 

# Example: initiate an STK push
curl -X POST https://lipaharakaapis.co.ke/api.php \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "action=stk_push" \
  -d "phone=254712345678" \
  -d "amount=500"

Keys are shown in full only once, at generation time. If you lose one, delete it and generate a new one.

Best practices

Server-side only
Store keys in your backend. Never put them in frontend JavaScript or mobile apps.
One key per service
Use separate keys for production, staging, and each client. Revoking one won't affect the others.
Rotate regularly
Generate a new key every 90 days, migrate your services, then delete the old one.
Revoke if leaked
If a key is exposed — even briefly — delete it immediately and issue a new one.