Authentication

​

API Authentication

​

Authentication Methods

​

Bearer Token Authentication

curl -X GET "https://api.hixbe.com/payment/payment_intents" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Xerobi-Version: 2026-01-01"

const response = await fetch('https://api.hixbe.com/payment/payment_intents', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Xerobi-Version': '2026-01-01',
    'Content-Type': 'application/json'
  }
});

import requests

headers = {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Xerobi-Version': '2026-01-01',
    'Content-Type': 'application/json'
}

response = requests.get('https://api.hixbe.com/payment/payment_intents', headers=headers)

<?php
$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 'https://api.hixbe.com/payment/payment_intents');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer YOUR_API_KEY',
    'Xerobi-Version: 2026-01-01',
    'Content-Type: application/json'
]);

$response = curl_exec($ch);
curl_close($ch);
?>

​

API Keys

​

Types of API Keys

• Secret Keys: Full access to all API operations. Keep these secure and never expose them in client-side code.
• Publishable Keys: Limited access for client-side operations (e.g., payment form integration).
• Restricted Keys: Scoped access with specific permissions and resource limitations.

​

Managing API Keys

​

API Versioning

-H "Xerobi-Version: 2026-01-01"

​

Security Best Practices

​

Key Security

• Never expose secret keys in client-side code
• Use environment variables for key storage
• Rotate keys every 90 days
• Monitor key usage in your dashboard
• Use restricted keys when possible

​

Request Security

• Always use HTTPS for all API requests
• Validate SSL certificates
• Implement proper error handling
• Use idempotency keys for critical operations
• Rate limit your requests appropriately

​

Environment Separation

• Use separate API keys for sandbox and production
• Test thoroughly in sandbox before going live
• Implement environment-specific configurations
• Use different subdomains for testing vs production

​

Authentication Errors

​

Common Error Codes

​

Error Response Format

{
  "success": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "The API key provided is invalid",
    "details": {
      "provided_key_prefix": "sk_test_..."
    }
  }
}

​

Testing Authentication

# Sandbox URL
curl -X GET "https://sandbox.api.hixbe.com/payment/payment_intents" \
  -H "Authorization: Bearer YOUR_SANDBOX_KEY" \
  -H "Xerobi-Version: 2026-01-01"

​

Need Help?