Midtrans · Authentication Profile

Midtrans Authentication

Authentication

Midtrans secures its APIs with http and apiKey across 3 declared security schemes, as derived from its OpenAPI definitions.

PaymentsPayment GatewayIndonesiaSoutheast AsiaSnapE-WalletVirtual AccountCardsBank TransferFintech
Methods: http, apiKey Schemes: 3 OAuth flows: API key in:

Security Schemes

serverKeyAuth http
scheme: basic
clientKeyQuery apiKey
· in: query ()
irisApiKey http
scheme: basic

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-12'
method: derived
source: openapi/midtrans-openapi.yml
summary:
  types:
  - http
  - apiKey
schemes:
- name: serverKeyAuth
  type: http
  scheme: basic
  description: >-
    HTTP Basic authentication for all server-to-server calls (Snap, Core API
    charge and lifecycle, Payment Link, Subscription). The Server Key is the
    username and the password is empty, so the header is
    `Authorization: Basic base64(SERVER_KEY:)`. Server Keys are issued per
    environment in the Midtrans dashboard; Sandbox keys are prefixed
    `SB-Mid-server-`.
  sources:
  - openapi/midtrans-openapi.yml
  - https://docs.midtrans.com/docs/api-authorization-headers
- name: clientKeyQuery
  type: apiKey
  in: query
  parameterName: client_key
  description: >-
    Public Client Key passed as the `client_key` query parameter on the
    browser-side card tokenization endpoints (`GET /v2/token`,
    `GET /v2/card/register`). Being public, it can only mint one-time card
    tokens - it cannot charge or read transactions. Sandbox keys are prefixed
    `SB-Mid-client-`.
  sources:
  - openapi/midtrans-openapi.yml
  - https://docs.midtrans.com/reference/get-token
- name: irisApiKey
  type: http
  scheme: basic
  description: >-
    Iris disbursement uses its own creator / approver API key over HTTP Basic
    (key as username, empty password), separate from the payment Server Key.
    Sensitive payout approval can additionally require an OTP.
  sources:
  - https://docs.midtrans.com/docs/disbursement-overview