Authorization header on every request:
Where to get your key
Sign in to the dashboard, open the workspace you want to integrate, and generate a key from the API Keys screen. Each workspace has one active secret key at a time; regenerating rotates the value and invalidates the previous one immediately.Environments
Keys are scoped to a single environment. The same physical workspace exists separately in sandbox and live, each with its own keys:
A sandbox key sent to
api.kwugwo.africa (or a live key sent to
sandbox-api.kwugwo.africa) returns 401 Unauthorized. There is
no shared key tier.
Two key types
Each workspace exposes two keys with different scopes:
Sample values look like:
/v1/*. The public
key is used by the Kwugwo hosted checkout and embedded widget; you do
not need to call those endpoints yourself.
Errors
If you regenerate a key, requests with the old value start failing
with
401 immediately; there is no grace period.
Keep secrets secret
- Store the key in an environment variable or secrets manager, never in source control.
- Use the sandbox key while you build; only swap in the live key when you’re ready to take real money.
- Rotate at the first sign of compromise. Regeneration takes effect instantly.