Biller | LakiPay Docs

API keys

Send the merchant key on every call in the API reference:

Required header

http

X-API-Key: {public_key}:{secret_key}

Format

Public key, a colon, then the secret. No Bearer prefix.

Scope

The key is the merchant. Products, customers, bills, and banks are isolated per key.

Storage

Keep the secret on your server only — never in a browser or mobile app.

Bearer tokens

Authorization: Bearer {jwt} is the dashboard login. Third-party servers do not use it for the routes in this guide.

Checkout initiation is stricter: POST /api/v2/biller/products-user/payment/initiate requires X-API-Key even when a dashboard token is present. Without the key the response is HTTP 401, message API key is required.

Required headers

Header	When	Value
`X-API-Key`	Every call in this guide	`{public_key}:{secret_key}`
`Content-Type`	Any request with a body	`application/json`

Request rules

Types

Money and quantities are JSON numbers. Ids are strings.

Dates

Subscription / usage query dates: YYYY-MM-DD. Usage timestamps: RFC3339.

Phones

9 to 15 digits.

Pagination

List calls require page and page_size (≥ 1): products, payments, merchant subscriptions, usage-based models.

Save from creates

product_id, pricing_plan_id, billing_model_id, customer_id, product_user_id, payment_id, payment_reference, bank_id, manual_payment_id.

Permissions and merchant status

The key must be allowed to take payments (CanProcessPayment). A key without that permission is rejected on reads and writes.

Sandbox

Test key only

Merchant status is sandbox. Only a test API key is accepted.

Production keys against a sandbox merchant return HTTP 403.

Active

Production key only

Merchant status is active. Only a production API key is accepted.

Test keys against an active merchant return HTTP 403.

What you send → result

What you send	Result
Test key, sandbox merchant, payment permission	The call runs as that merchant.
Production key, active merchant, payment permission	The call runs as that merchant.
No `X-API-Key` on a normal biller route	HTTP `401`, `Authentication token missing`.
No `X-API-Key` on initiate	HTTP `401`, `API key is required`.
A value that is not `public:secret`	HTTP `401`, `Invalid API key format`.
Unknown public key or wrong secret	HTTP `401`, `Invalid API key`.
Key type does not match merchant status	HTTP `403`, `API key type is not valid for this merchant status`.
Key cannot take payments	HTTP `403`, `API key does not have payment processing permission`.

Routes the API key does not open

Dashboard bearer only

GET /api/v2/biller/products/categories

GET /api/v2/biller/products/all/public

GET /api/v2/biller/products-user/search

GET /api/v2/biller/notifications/history

GET /api/v2/biller/analytics/summary

GET /api/v2/biller/export/payments

GET /api/v2/admin/biller/products/all

GET /api/v2/admin/biller/products-user/all

POST /api/v2/biller/usage/webhook

An API key alone returns HTTP 401, message Authentication token missing.