> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paj.cash/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every v2 request is authenticated with a business API key.

The v2 API uses a single static API key, sent as an `x-api-key` header on every
request. There is no OAuth flow, no token exchange, and no per-user
authentication — the key identifies your **business**, and everything you do is
scoped to it.

```bash theme={null}
curl https://api.paj.cash/pub/v2/rate?currency=NGN \
  -H "x-api-key: $PAJ_API_KEY"
```

## What the key determines

<AccordionGroup>
  <Accordion title="Which business owns the accounts you register" icon="building">
    Bank accounts created through `POST /pub/v2/bank-account` are attributed to
    the business behind the key. This is what ties deposits and payouts back to
    you.
  </Accordion>

  <Accordion title="The rates you are quoted" icon="percent">
    `GET /pub/v2/rate` returns rates with your business's fee already applied, so
    two businesses calling the same endpoint at the same moment can legitimately
    see different numbers.
  </Accordion>
</AccordionGroup>

## Getting a key

Keys are issued per business from the Paj dashboard. A business can hold several
keys — give each integration or environment its own so one can be rotated
without taking the others down.

## Keeping it secret

The key is a bearer credential: anyone holding it can register bank accounts as
your business. Treat it accordingly.

<Warning>
  Never ship the key in a mobile app, a browser bundle, or anything else a user
  can read. Call the Paj API from your backend and expose only what your own
  clients need.
</Warning>

Store it in your server's environment or secret manager, keep it out of version
control and logs, and rotate it if it is ever exposed.

## When authentication fails

A missing or unrecognised key returns `401 Unauthorized`:

```json theme={null}
{
  "statusCode": 401,
  "message": "No API key provided",
  "error": "Unauthorized"
}
```

The message is `"Invalid API key"` when a key was sent but did not match a
business. Both cases are permanent failures — retrying will not help, so fix the
credential rather than backing off.