HitPay · Authentication Profile

Hitpay Authentication

Authentication

HitPay secures its APIs with apiKey across 2 declared security schemes, as derived from its OpenAPI definitions.

PaymentsFintechPayNowSoutheast AsiaSMB
Methods: apiKey Schemes: 2 OAuth flows: API key in:

Security Schemes

businessApiKey apiKey
· in: header ()
platformKey apiKey
· in: header ()

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-17'
method: derived
source: openapi/hitpay-openapi.yml
summary:
  types:
  - apiKey
schemes:
- name: businessApiKey
  type: apiKey
  in: header
  headerName: X-BUSINESS-API-KEY
  description: >-
    Per-merchant business API key from Dashboard > Settings > Payment Gateway >
    API Keys. Sent on every request. Sandbox uses a separate test key against
    https://api.sandbox.hit-pay.com/v1.
  sources:
  - openapi/hitpay-openapi.yml
  - https://docs.hitpayapp.com/apis
- name: platformKey
  type: apiKey
  in: header
  headerName: X-PLATFORM-KEY
  description: >-
    Additional key sent alongside X-BUSINESS-API-KEY by e-commerce platforms /
    aggregators using the Platform APIs to act on behalf of onboarded merchants.
  sources:
  - https://docs.hitpayapp.com/apis/guide/platform-apis
webhookVerification:
  header: Hitpay-Signature
  algorithm: HMAC-SHA256
  secret: merchant salt value (Dashboard > Payment Gateway > API)
  note: >-
    Webhook authenticity is verified by computing HMAC-SHA256 of the JSON payload
    using the salt value as the key and comparing against the Hitpay-Signature
    header. This is inbound webhook verification, distinct from request auth.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/hitpay-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.