Authentication
The StarPay SGH API uses your Secret Key to authenticate every request. Include it as a Bearer token in the Authorization header.
Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxYour keys
| Key | Prefix | Where it's used |
|---|---|---|
| Secret Key | sk_test_ | Server-side API calls (this is the one you authenticate with) |
| Public Key | pk_test_ | Reserved for future client-side use — not required for current endpoints |
| Webhook Secret | whsec_ | Verifying webhook signatures — see Webhooks |
🔒 Never expose your Secret Key in client-side code, mobile apps, or public repositories. Treat it like a password.
Missing or invalid key
Requests without a valid key return 401 Unauthorized:
{ "message": "Invalid or inactive API key." }Regenerating keys
You can regenerate your keys anytime from your dashboard. This immediately invalidates the old Secret Key and Webhook Secret — update your integration before regenerating in production.