Authentication

Secure your integration with BudPay's straightforward authentication system. Get your API keys, understand when to use each one, and start making authenticated requests in minutes.

Test and Live Environments

BudPay gives you two separate environments to work with:

Switch between environments using the toggle at the bottom of your dashboard sidebar. Your API keys update automatically when you switch.

Your API Keys

You have two types of keys, each with a specific purpose:

Get Your API Keys

1. Log in to your BudPay Dashboard (opens in a new tab)
2. Go to Settings > API Credentials
3. Copy your keys

If you suspect your secret key has been compromised, regenerate it immediately from the same page. The old key will stop working right away.

Making Authenticated Requests

Include your secret key in the Authorization header of every API request:

Authorization: Bearer YOUR_SECRET_KEY
Content-Type: application/json

Missing or invalid keys return a 401 Unauthorized error:

{
    "success": false,
    "message": "Authentication failed"
}

HMAC Signature for Payouts and Bills

Payout and Bills Payment endpoints require an extra layer of security: HMAC-SHA-512 signature authentication.

Why HMAC?

The signature verifies two things:

• Authentication: The request comes from you
• Integrity: The payload has not been tampered with

Required Headers

Authorization: Bearer YOUR_SECRET_KEY
Encryption: YOUR_HMAC_SIGNATURE
Content-Type: application/json

Generate the Signature

Create an HMAC-SHA-512 hash of your request body using your secret key:

const crypto = require('crypto');
 
const payload = JSON.stringify({
    // your request body
});
 
const signature = crypto
    .createHmac('sha512', 'YOUR_SECRET_KEY')
    .update(payload)
    .digest('hex');

import hmac
import hashlib
import json
 
payload = json.dumps({
    # your request body
})
 
signature = hmac.new(
    b'YOUR_SECRET_KEY',
    payload.encode('utf-8'),
    hashlib.sha512
).hexdigest()

<?php
$payload = json_encode([
    // your request body
]);
 
$signature = hash_hmac('sha512', $payload, 'YOUR_SECRET_KEY');

Quick Reference