Authentication

All MALIPOPAY API requests are authenticated using an API key passed in the request header.

API Key Header

apiToken: YOUR_API_KEY

Getting your API key

1. Log in to the MALIPOPAY dashboard
2. Navigate to Settings → API Keys
3. Copy your Secret Key

Keep your API key secure. Never expose it in frontend code or commit it to version control.

One environment, one key

There is no separate sandbox host and no separate test key. Every project has a single secret key against a single base URL:

https://core-prod.malipopay.co.tz

What changes as you mature is not the key but your go-live status. Until your account is approved, it behaves as a sandbox: you can only transact with recipients you have registered under Settings → Test Recipients, and each direction is capped at TZS 100,000 per day. Approval lifts the whitelist and raises the limits. The key, the URL and your code stay the same. See Testing and Going Live.

Rotating a key expires the previous one immediately, so deploy the new value before you rotate.

Approving disbursements

Payouts need a second factor on top of the API key. When you approve from your own server, that factor is your IP address: POST /api/v2/payment/approve only accepts calls from an address registered on your project. When you approve from the dashboard, it is an OTP instead. See IP Whitelisting.