Cari Finance

Authentication

You'll need to authenticate your requests to access any of the endpoints in the Cari Finance API. In this guide, we'll look at how authentication works. Requests from your server are authenticated with an API key.

API Key Authentication

Cari Finance uses API keys to authenticate requests. Your API keys carry many privileges, so be sure to keep them secure. Do not share your API keys in publicly accessible areas such as GitHub, client-side code, etc.

API keys are available in both live and test environments through the Developers Dashboard.

Key Types and Environments

All API keys start with a prefix that indicates both the key type and the environment:

  • Secret keys (sk_live_, sk_test_) are for your server. They can use every route for their account and mode. Never put one in a web page, a mobile app or a repository. A secret key is shown once, when you create it in the Developers Dashboard; after that only a masked form such as sk_live_••••1a2b is shown.
  • Publishable keys (pk_live_, pk_test_) are safe in the browser. They can do two things only: read a payment session and confirm it with its client_secret. Every other route answers 403 with error_code: "forbidden_key_type".

The environment is determined from the key prefix. Test keys never touch live data and live keys never touch test data. Live keys work only after your email is verified and your business verification is approved.

Using API Keys

Include your secret key in the Authorization header of server-side requests, using the Bearer scheme:

Example request with a secret key

curl https://api.cari.finance/charges \
  -H "Authorization: Bearer sk_test_YOUR_SECRET_KEY"

Test vs. Live Keys

  • Test Mode: Use test keys (sk_test_ on your server, pk_test_ in the browser) when developing or testing your integration. Test keys create transactions in a safe, sandboxed environment that doesn't affect real payment methods or accounts.

  • Live Mode: Use live keys (sk_live_ and pk_live_) only when you're ready to process real transactions with real payment methods.

Always ensure you're using the correct key for your current stage of development. Test mode allows you to simulate various payment scenarios without real money movement.

Using the API from your server

There are no server libraries. Send the secret key in the Authorization header with your language's HTTP client, as in the example above. Secret keys are created, rolled and revoked on the Developers page, which needs a dashboard sign-in; they cannot be created with an API key.

When a key is missing, wrong or revoked, the API answers 401 with error_code: "invalid_credentials" whatever the reason, so a failed request does not tell you which part was wrong.

Was this page helpful?