Most public API endpoints require your Kyshi secret key in the x-api-key header.
x-api-key: sk_test_xxxxxxxxxxxxxxxxxxxxxUse secret keys only from your backend. Do not expose them in browsers, mobile apps, frontend bundles, public repositories, or customer-facing logs.
Test And Live Mode
Kyshi resolves the request mode from the key you send.
| Key Prefix | Mode | Use For |
|---|---|---|
sk_test_ | Test | Development, QA, sandbox transactions, and simulated virtual-account credits. |
sk_live_ | Live | Production payments, real 22collections, payouts, and live reconciliation. |
Test and live data are separate. A customer, wallet, beneficiary, plan, or transaction created in test mode is not available in live mode.
Public Endpoints
Some lookup or checkout endpoints are intentionally public in the backend and do not require x-api-key. In the generated API Reference, these endpoints are shown without the global auth requirement.
Examples include public payment-link verification and VA transfer bank listing.
Failed Authentication
Requests without a valid key return a 401 response. Treat this as a configuration problem: check the key, environment, and whether the endpoint expects server-side authentication.