Authentication

Every request carries a project API key. A key's permissions decide whether it can only take money in or can also send money out.

RazPay uses per-project API keys. Send the key as a Bearer token on every request:

Authorization: Bearer rzp_live_ab12cd34ef56gh78ij90kl12mn34op56qr78st

Requests must use HTTPS. A key belongs to one project, so every request is scoped to that project’s transactions, providers and settings.

Creating and revoking keys

Org admins create keys from the project’s page in the dashboard, under API keys. A key is shown in full exactly once, when it’s created. RazPay stores only a hash of it, so a lost key can’t be recovered: revoke it and create a new one.

Keys are either live or test. Revoking a key takes effect immediately.

Permissions

A key’s permissions decide what it may do. Choose them when you create the key.

Permission	Allows
`collect`	Collecting payments, pre-approvals, invoices and messages to payers.
`payout`	Sending payouts from your disbursement account, and reading them back.
`refund`	Refunding successful payments.

Every key can read: transactions, providers, wallet checks and balances need no extra permission.

payout and refund move money out of your accounts, so they are never granted by default. Give them only to the keys that need them, ideally a separate key on a separate service. Keys created before permissions existed have collect only.

A key without the permission an endpoint needs gets a 403:

{
  "success": false,
  "message": "this API key does not have the payout permission",
  "data": null
}