Authorization header on every request:
Where to get your key
Sign in to the dashboard, open the workspace you want to integrate, and generate a key from the API Keys screen. Each workspace has one active secret key at a time; regenerating rotates the value and invalidates the previous one immediately.Environments
Keys are scoped to a single environment. The same physical workspace exists separately in sandbox and live, each with its own keys:
Sandbox keys end in
_t, the same marker as sandbox
IDs; live keys never do. A quick
key.endsWith('_t') tells you which environment a key belongs to. Keep
each key next to the base URL it belongs to (for example
KWUGWO_BASE_URL and KWUGWO_SECRET_KEY in the same environment
config).
A sandbox key sent to api.kwugwo.africa (or a live key sent to
sandbox-api.kwugwo.africa) returns 401 Unauthorized. There is
no shared key tier.
Two key types
Each workspace exposes two keys with different scopes:
Sample values look like:
_t. The
4-character segment after the prefix matches the workspace segment in
your resource IDs, and it’s the same in a workspace’s
public and secret keys.
Every endpoint in this reference takes the secret key. The public
key is only for KwugwoCheckout.init in the
browser.
Errors
A
401 body is { "message": "Invalid token" } (or No token provided, Invalid token format, Invalid token type).
If you regenerate a key, requests with the old value start failing
with 401 immediately; there is no grace period.
Keep secrets secret
- Store the key in an environment variable or secrets manager, never in source control.
- Use the sandbox key while you build; only swap in the live key when you’re ready to take real money.
- Rotate at the first sign of compromise. Regeneration takes effect instantly.