API security
The security of your funds and data comes first. Besides API-key authentication, sensitive dashboard actions require an extra confirmation.
API key authentication
Every request to the SOAMTAR API must be authenticated with a secret key in the Authorization header.
Authorization: Bearer sk_live_...Key types
- Test keys (
sk_test_...): simulate payments in the sandbox. No real money moves. - Live keys (
sk_live_...): real transactions. Keep them strictly confidential. - Public keys (
pk_...): browser and mobile SDKs only.
Request signing (optional)
Mutating API requests can additionally carry Soamtar-Timestamp and Soamtar-Signature: v1=…, an HMAC-SHA256 of "<timestamp>.<METHOD>.<path>" with your secret key. Every server SDK has a switch for it. See Authentication → Request signing.
OTP confirmation in live mode
Revealing a key or secret, or changing critical information from the dashboard:
- Test mode: immediate.
- Live mode: a one-time code (OTP) is required.
SOAMTAR sends a 6-digit code to:
- Email: the signed-in user's address.
- SMS: the phone number configured on the merchant account (
+232…).
Actions protected by OTP in live mode:
- Revealing an API key or a webhook secret.
- Changing settlement (bank account) details.
- Changing the business profile.
- Changing the user password.
- Deleting a webhook endpoint.
Webhook validation
The signing secret is unique per endpoint. It lets you compute an HMAC-SHA256 over the request body to check that a notification comes from SOAMTAR. See Webhooks.
Managing the secret
- Reveal: from the dashboard (OTP in live mode), or through the API with
GET /v1/webhooks/{endpoint_id}/secretand your secret key. - Delete: deleting an endpoint in live mode also requires an OTP.
Best practices
- Key rotation: renew your API keys every 90 days, or immediately if a leak is suspected.
- IP allowlist: restrict your production keys to your server IP addresses in the dashboard settings.
- Dashboard access: protect every dashboard account with a strong, unique password.