Authentication and environments
Authenticate every merchant API request with X-Api-Key; the key prefix selects the environment.
Key points
- kuko_test_ keys use the sandbox without moving real money. kuko_live_ keys require merchant approval.
- Keep keys on your server. Never place them in browser code, mobile apps, or public repositories.
- Optional IP allowlists and merchant rate limits add protection. Rotate compromised keys in the portal.
Example
bash
curl "https://api.kukopay.com/v1/balance" \
-H "X-Api-Key: kuko_test_mch_xxxxx_a1b2c3d4"