Authentication

API Authentication

All API requests require authentication using your API credentials in the request headers.

Using Your API Credentials

Authenticate every request with your API key in the x-api-key header. You can also include your merchant ID in the x-merchant-id header:

x-api-key: YOUR_API_KEY
x-merchant-id: YOUR_MERCHANT_ID

x-merchant-id is optional.

Example Request

curl -X POST https://api.sandbox.cheqpay.mx/pos/v2/payment-orders \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-merchant-id: YOUR_MERCHANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "externalId": "order-123",
    "amount": 10000,
    "currency": "MXN"
  }'

Keep your API keys secure. Never share them publicly or commit them to version control.

Best Practices

Store Keys Securely

Always use environment variables to store your API credentials:

// ✅ Good - Use environment variables
const apiKey = process.env.CHEQPAY_API_KEY;

// ❌ Bad - Never hardcode
const apiKey = 'sk_live_abc123...';

Use Different Keys for Each Environment

You’ll receive separate API keys for:

Sandbox - For testing and development
Production - For live payments

Never use production keys in your development environment.

Rotate Keys Regularly

For security, periodically rotate your API keys:

Generate a new key in your dashboard
Update your application with the new key
Test thoroughly
Deactivate the old key

Getting Your API Keys

Sign up for a Cheqpay account
Navigate to your dashboard
Go to Settings → API Keys
Copy your keys for sandbox and production

Contact our support team at support@cheqpay.mx if you need help setting up your API keys.

Getting Started

Essentials

Features

Testing

Guides

API Reference

Payment Orchestrator API

Link Product API

API Authentication

Using Your API Credentials

Example Request

Best Practices

Store Keys Securely

Use Different Keys for Each Environment

Rotate Keys Regularly

Getting Your API Keys

​API Authentication

​Using Your API Credentials

​Example Request

​Best Practices

​Store Keys Securely

​Use Different Keys for Each Environment

​Rotate Keys Regularly

​Getting Your API Keys

API Authentication

Using Your API Credentials

Example Request

Best Practices

Store Keys Securely

Use Different Keys for Each Environment

Rotate Keys Regularly

Getting Your API Keys