Kora · Authentication Profile

Korapay Authentication

Authentication

Kora secures its APIs with http, hmac, and encryption across 4 declared security schemes, as derived from its OpenAPI definitions.

PaymentsPayment GatewayAfricaNigeriaCollectionsPayoutsDisbursementsVirtual Bank AccountCardsFintech

Methods: http, hmac, encryption Schemes: 4 OAuth flows: API key in:

Security Schemes

secretKeyAuth http

scheme: bearer

publicKeyAuth http

scheme: bearer

cardPayloadEncryption encryption

scheme: AES-256

webhookSignature hmac

scheme: HMAC-SHA256

Source

Authentication Profile

generated: '2026-07-12'
method: documented
source: https://developers.korapay.com/docs/api-keys
summary:
  types:
  - http
  - hmac
  - encryption
schemes:
- name: secretKeyAuth
  type: http
  scheme: bearer
  description: 'Secret API key (sk_...) passed as `Authorization: Bearer [example key]`.
    Required for server-side and financial operations - payouts, balances, virtual
    bank accounts, refunds, conversions, and charge verification. Keep confidential;
    never expose in client-side code. Test and Live modes use different secret keys.'
  sources:
  - https://developers.korapay.com/docs/api-keys
  - https://developers.korapay.com/docs/balance-api
- name: publicKeyAuth
  type: http
  scheme: bearer
  description: 'Public API key (pk_...) used from client-side code to initiate
    transactions (for example, initializing a checkout charge). Non-sensitive; cannot
    access financial data or modify the account beyond initiating transactions. Test
    and Live modes use different public keys.'
  sources:
  - https://developers.korapay.com/docs/api-keys
- name: cardPayloadEncryption
  type: encryption
  scheme: AES-256
  description: 'Card charge payloads must be AES-256 encrypted with your account
    encryption key and submitted as a single `charge_data` string to POST /charges/card.
    Card payments additionally require the feature to be enabled on your account and
    PCI DSS Level 1 certification.'
  sources:
  - https://developers.korapay.com/docs/accepting-card-payments-with-apis
- name: webhookSignature
  type: hmac
  scheme: HMAC-SHA256
  header: x-korapay-signature
  description: 'Webhook requests from Kora carry an `x-korapay-signature` header that
    is an HMAC SHA-256 of ONLY the `data` object of the payload, signed with your
    secret key. Recompute and compare before delivering value to guarantee the
    request originated from Kora.'
  sources:
  - https://developers.korapay.com/docs/webhooks
notes: >-
  Kora uses API-key authentication (no OAuth). Every account has separate Test and
  Live keys; ensure you use the correct mode's keys. Payout IP whitelisting is also
  available on the dashboard as an additional control.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com