Paga · Authentication Profile

Paga Authentication

Authentication

Paga secures its APIs with http and apiKey across 4 declared security schemes, as derived from its OpenAPI definitions.

PaymentsMobile MoneyFintechCollectionsNigeria
Methods: http, apiKey Schemes: 4 OAuth flows: API key in:

Security Schemes

basic_auth http
scheme: basic
principal apiKey
· in: header ()
credentials apiKey
· in: header ()
hash apiKey
· in: header ()

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-17'
method: modeled-from-docs
source: https://developer-docs.paga.com/docs/introduction
summary:
  types:
  - http
  - apiKey
schemes:
- name: basic_auth
  type: http
  scheme: basic
  description: >-
    Collect API and Direct Debit API authenticate with HTTP Basic using
    base64(publicKey:secretKey) - the account principal (public key) and
    credential (secret key).
  appliesTo:
  - Paga Collect API
  - Paga Direct Debit API
  sources:
  - https://developer-docs.paga.com/docs/paga-collect-api
- name: principal
  type: apiKey
  in: header
  headerName: principal
  description: Business API public key (principal / merchant public ID), sent as a header.
  appliesTo:
  - Paga Business API
  sources:
  - https://developer-docs.paga.com/docs/introduction
- name: credentials
  type: apiKey
  in: header
  headerName: credentials
  description: Business API secret key (credential / password), sent as a header.
  appliesTo:
  - Paga Business API
  sources:
  - https://developer-docs.paga.com/docs/introduction
- name: hash
  type: apiKey
  in: header
  headerName: hash
  description: >-
    Every operation additionally requires a SHA-512 hash header computed over an
    operation-specific ordered concatenation of request parameters followed by
    the account hash key (HMAC key from the Business dashboard), joined with no
    separators. Example order for Deposit To Bank: referenceNumber + amount +
    destinationBankUUID + destinationBankAccountNumber + hashKey. The hash key
    itself is never transmitted.
  appliesTo:
  - Paga Business API
  - Paga Collect API
  - Paga Direct Debit API
  sources:
  - https://developer-docs.paga.com/docs/handling-hash
notes: >-
  Credentials (public key, secret key, hash key) are issued from the Paga
  Business Account dashboard under Developer Tools > API keys, with separate
  test and live sets. The Business API additionally requires the caller's IP
  address to be whitelisted before access is granted. Paga Connect is a
  separate OAuth 2.0 hosted-checkout flow and is not covered by the hash scheme
  above.
regions:
- Nigeria
currency: NGN