Skip to main content
The v2 API uses a single static API key, sent as an x-api-key header on every request. There is no OAuth flow, no token exchange, and no per-user authentication — the key identifies your business, and everything you do is scoped to it.

​
What the key determines

Bank accounts created through POST /pub/v2/bank-account are attributed to the business behind the key. This is what ties deposits and payouts back to you.
GET /pub/v2/rate returns rates with your business’s fee already applied, so two businesses calling the same endpoint at the same moment can legitimately see different numbers.

​
Getting a key

Keys are issued per business from the Paj dashboard. A business can hold several keys — give each integration or environment its own so one can be rotated without taking the others down.

​
Keeping it secret

The key is a bearer credential: anyone holding it can register bank accounts as your business. Treat it accordingly.
Never ship the key in a mobile app, a browser bundle, or anything else a user can read. Call the Paj API from your backend and expose only what your own clients need.
Store it in your server’s environment or secret manager, keep it out of version control and logs, and rotate it if it is ever exposed.

​
When authentication fails

A missing or unrecognised key returns 401 Unauthorized:
The message is "Invalid API key" when a key was sent but did not match a business. Both cases are permanent failures — retrying will not help, so fix the credential rather than backing off.