Authentication

Overview

Transaction API supports two authentication methods depending on the endpoint you’re using:

JWT Authentication - For user account operations
API Key Authentication - For payment and merchant operations

JWT Authentication

JWT tokens are used for user account operations like registration, login, and profile management.

Getting a JWT Token

Use the /auth/register or /auth/login endpoints to get a JWT token.

Include in Headers

Add the token to the Authorization header:

Authorization: Bearer <jwt_token>

Example

# Login to get JWT token
curl -X POST https://api.transaction.gg/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "password123"
  }'

# Use JWT token for authenticated requests
curl -X GET https://api.transaction.gg/auth/me \
  -H "Authorization: Bearer jwt_token_here"

API Key Authentication

API keys are used for payment processing and merchant operations.

API Key Types

Public Key

Format: pk_*Used for:

Creating payments
Public operations

Safe to use in client-side code

Secret Key

Format: sk_*Used for:

Merchant operations
Wallet management
Webhook logs

Never expose in client-side code

Getting API Keys

Log in to your dashboard
Navigate to API Keys section
Copy your public and secret keys

Example

# Create payment with public key
curl -X POST https://api.transaction.gg/payment/create \
  -H "Authorization: Bearer pk_your_public_key" \
  -H "Content-Type: application/json" \
  -d '{"amount": "29.99", "currency": "USD"}'

# Check wallet balance with secret key
curl -X GET https://api.transaction.gg/merchant/wallet/balances \
  -H "Authorization: Bearer sk_your_secret_key"

Token Expiration

JWT Tokens

Expire after 24 hours
Use /auth/login to get new token
No refresh token mechanism

API Keys

Do not expire
Can be regenerated from dashboard
Regeneration invalidates old keys

Security Best Practices

Store Keys Securely

Use environment variables or secure key management systems.

Use HTTPS

Always make requests over HTTPS to protect credentials.

Rotate Keys Regularly

Regenerate API keys periodically for enhanced security.

Monitor Usage

Check your dashboard for unusual API activity.

Error Handling

Common authentication errors:

Error Code	Status	Description
`UNAUTHORISED`	401	Invalid or missing authentication
`INVALID_CREDENTIALS`	401	Invalid login credentials
`RATE_LIMITED`	429	Too many authentication attempts

Rate Limits: Authentication endpoints are limited to 5 requests per minute to prevent brute force attacks.

Getting started

Essentials

Integration

Overview

JWT Authentication

Getting a JWT Token

Example

API Key Authentication

API Key Types

Public Key

Secret Key

Getting API Keys

Example

Token Expiration

JWT Tokens

API Keys

Security Best Practices

Error Handling

​Overview

​JWT Authentication

​Getting a JWT Token

​Example

​API Key Authentication

​API Key Types

Public Key

Secret Key

​Getting API Keys

​Example

​Token Expiration

JWT Tokens

API Keys

​Security Best Practices

​Error Handling

Overview

JWT Authentication

Getting a JWT Token

Example

API Key Authentication

API Key Types

Getting API Keys

Example

Token Expiration

Security Best Practices

Error Handling