The Fortpesa API authenticates with API keys. Every request must carry your key — requests without a valid key are rejected with 401.

Creating a key

In the dashboard, open Settings → API keys and create a key. The full key is shown once at creation time — copy it immediately; only a short prefix is stored for display afterwards. The key identifies your merchant account: all data returned by the API (transactions, balances) is scoped to it.

Sending your key

Send the key in either the Authorization header (preferred) or X-API-Key:
Keep keys on your server. Anything shipped to a browser or mobile app can be extracted and used against your account.

Revoking a key

If a key leaks, revoke it in Settings → API keys. Revoked keys immediately stop working — subsequent requests return 401 with code INVALID_API_KEY. Issue a replacement key and update your integration.

Rate limits

The API allows up to 120 requests per minute; requests beyond the limit return 429 Too Many Attempts. Batch or cache reads where you can; if you need a higher limit, contact support.

Auth errors

Full error reference: Errors.