PayTabs · Authentication Profile

Paytabs Authentication

Authentication

PayTabs secures its APIs with apiKey across 2 declared security schemes, as derived from its OpenAPI definitions.

PaymentsPayment GatewayFintechMENASaudi ArabiaCardsmada
Methods: apiKey Schemes: 2 OAuth flows: API key in:

Security Schemes

server_key apiKey
· in: header ()
client_key apiKey
· in: header ()

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-17'
method: derived
source: openapi/paytabs-openapi.yml
summary:
  types:
  - apiKey
notes: >-
  PayTabs PT2 authenticates server-to-server calls with a merchant server key
  sent as the raw value of the `authorization` HTTP header (NOT an OAuth/Bearer
  token). The `profile_id` in the request body identifies which profile the
  server key acts on. A separate client key is used for browser-side own-form /
  tokenization. Keys are region-scoped: a key must be used against the host that
  matches its region (e.g. secure.paytabs.sa for KSA) or authentication fails.
schemes:
- name: server_key
  type: apiKey
  in: header
  header: authorization
  format: server key (e.g. SXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX)
  sources:
  - openapi/paytabs-openapi.yml
  - https://support.paytabs.com/en/support/solutions/articles/60000709801-how-to-get-my-authentication-integration-api-keys-
- name: client_key
  type: apiKey
  in: header
  header: client key
  format: CXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX
  usage: Browser-side own-form and card tokenization; paired with profile_id.
  sources:
  - https://support.paytabs.com/en/support/solutions/articles/60000709773-authentication-integration-api-keys