Skip to main content
All API requests must be authenticated using an API key passed in the x-api-key header.

​
API Keys

Kyren Pay uses API keys to authenticate requests. You can manage your API keys from the Merchant Dashboard. There are two types of API keys:
Key TypePrefixPurpose
Livekyren_live_Production environment — real payments
Testkyren_test_Sandbox environment — no real charges

​
Making Authenticated Requests

Include your API key in the x-api-key header of every request: 
curl https://api.kyren.top/v1/products \
  -H "x-api-key: kyren_live_xxxxxxxxxxxxxxxxxxxx"
Keep your API keys secure.
  • Never expose API keys in client-side code (JavaScript, mobile apps)
  • Never commit API keys to version control
  • Use environment variables to store keys in your server
  • Regenerate keys immediately if they are compromised

​
Environments

EnvironmentBase URLAPI Key Prefix
Productionhttps://api.kyren.topkyren_live_
Sandboxhttps://test-api.kyren.topkyren_test_
Test and live API keys are completely separate. Data created with test keys is not visible in the live environment, and vice versa.

​
Regenerating API Keys

If your API key is compromised, you can regenerate it from the Dashboard:
  1. Go to Dashboard > Developer
  2. Click Regenerate next to the key you want to replace
  3. Confirm the action
Regenerating a key immediately invalidates the old key. Make sure to update all your integrations with the new key.

​
Error Responses

If authentication fails, the API returns a 401 Unauthorized response: 
{
  "code": 401,
  "message": "Unauthorized"
}
Common causes:
  • Missing x-api-key header
  • Invalid or expired API key
  • Using a test key against the production URL (or vice versa)