One key. One application.
Authenticate server-to-server requests with a named application secret.
Bearer authentication
Send the application secret in the Authorization header. NuePay derives the account and application from the authenticated key; do not send a nickname for identification.
curl https://api.nuepay.net/v1/application \
-H "Authorization: Bearer $NUEPAY_TEST_KEY"GET /application returns application_id, application_name, account_number, mode and livemode.
Live and sandbox keys
| Key prefix | Environment | Behavior |
|---|---|---|
np_test_ | Sandbox | Simulated funds and isolated payment records. |
np_live_ | Live | Real collections and payouts; never embed in browser or mobile app code. |
Reveal and regenerate secrets in the dashboard using your transactional PIN. Regenerating a sandbox secret leaves the live secret intact. A regenerated secret replaces the previous secret immediately.
Protect your secret
Store secrets in server environment variables or your hosting provider’s secret manager. Keep them out of source control, URLs, logs, frontend bundles and support messages. The API uses HTTPS and returns non-cacheable responses.
Existing integrations keep working
https://platform.nuepay.net/api/v1 remains supported. The previous authentication headers X-NuePay-Account and X-NuePay-Secret still work. When using Bearer authentication, an account header is unnecessary; if supplied, it must match.
Older hash-only secrets may need one successful legacy authentication or regeneration before account-free Bearer lookup is available.