SECURITY & AUTH

Authentication & Key Management

Learn how OnnXpay authenticates incoming API requests, manages secret API keys, and protects merchant accounts against unauthorized balance debits.

1. Payin Header Authentication (`x-api-key`)

All Payin deposit endpoints require your secret key passed as a custom HTTP header named x-api-key.

JAVASCRIPT

// Payin API Header Authentication Example
fetch('https://checkout.onnxpay.com/api/create-order', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': 'YOUR_MERCHANT_SECRET_KEY'
  },
  body: JSON.stringify({ ... })
});

2. Payout Body Authentication (`api_key`)

All Payout settlement endpoints accept your secret key inside the request JSON payload under the field api_key.

JAVASCRIPT

// Payout API Body Authentication Example
fetch('https://onnxpay.com/api/payout/create', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    api_key: 'YOUR_MERCHANT_SECRET_KEY',
    amount_inr: 1000,
    ...
  })
});

Security Best Practices

Server-Side Only Calls

Never expose your API key in browser scripts, mobile app bundles, or public HTML repositories. Always initiate API requests from your backend server.

Webhook Endpoint Security

Ensure your webhook receiver route is publicly accessible over HTTPS and validates order parameters before triggering internal status updates.