API Authentication

All API requests to BizFlex Africa must be authenticated. We use a header-based authentication system to ensure that every transaction is secure and attributed to the correct merchant.

The x-api-key Header

To authenticate your requests, you must include your Secret Key in the x-api-key field of your HTTP request header.

Authentication Headers

Header	Value	Description
Content-Type	application/json	Required for all POST/PUT requests.
x-api-key	_xxxx...	Your unique BizFlex API Key.

🔑

Where is my key?

You can find your API Key in the Settings > API Keys section of your BizFlex Africa Dashboard.

---

Implementation Example

To make a successful call to a protected BizFlex route, structure your request as shown below:

Using cURL

Bash

curl https://api.bizflex.africa/v1/transactions \
  -H "x-api-key: YOUR_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -X GET

Using JavaScript (Axios)

JavaScript

const axios = require('axios');

const options = {
  url: 'https://api.bizflex.africa/v1/payouts',
  method: 'POST',
  headers: {
    'Accept': 'application/json',
    'Content-Type': 'application/json',
    'x-api-key': process.env.BIZFLEX_SECRET_KEY
  },
  data: {
    amount: 5000,
    currency: "KES",
    recipient: "254700000000"
  }
};

axios(options)
  .then(response => console.log(response.data))
  .catch(error => console.error(error));

---

Error Responses

If you attempt to access a protected route without a valid key, the BizFlex API will return a 401 Unauthorized error.

Status Code	Meaning	Reason
401	Unauthorized	The x-api-key is missing, invalid, or expired.
403	Forbidden	The key is valid, but you don't have permission for this specific action (e.g., using a Test Key on a Live route).

Security Checklist

• Environment Variables: Store your x-api-key in a .env file; never hardcode it in your frontend or public repositories.
• Server-Side Only: Only make API calls containing your Secret Key from your backend server.
• Key Rotation: If you accidentally commit your key to GitHub or expose it, rotate it immediately in the BizFlex Dashboard.