Skip to main content
Every request to the Z2Pay API is authenticated via an API key, sent in the x-api-key header. 
curl https://api.sandbox.z2pay.com/transactions \
  -H "x-api-key: z2_psp_sk_suachavesecreta"
The secret key (sk) grants full access to your account. Never expose it in the frontend, mobile apps, public repositories, or logs. Use it only on your server.

​
Key format

Keys follow the pattern z2_{scope}_{type}_{random} (256 bits of entropy): 
z2_psp_sk_Kx8y9pQ1n3...      secret key for the PSP product
z2_chk_pk_AbC9dEf2...        publishable key for the Checkout product
PartValuesMeaning
Scopepsp, chk, stl, afProduct (PSP, Checkout, Settle, Anti-fraud).
Typesk (secret), pk (publishable)Access level.

​
Secret (sk) vs. Publishable (pk)

Secret key (sk)

Full access (create, read, update, refund). Backend only.

Publishable key (pk)

Restricted to public-facing operations (e.g., tokenization in the frontend). Safe to expose in the browser.

​
How to get your key

  1. Go to the Z2Pay Dashboard.
  2. For test keys, switch to the sandbox environment and generate credentials there.
  3. For production keys, generate them in the production environment.
  4. Copy the key at creation time — for security reasons, it is displayed only once (afterwards it is masked, e.g., z2_psp_sk_KxY8…3pQ1).
Sandbox and production keys share the same format, but are generated in separate environments and are not interchangeable. A sandbox key only works against *.sandbox.z2pay.com.

​
Authentication responses

SituationStatusResponse
x-api-key header missing or invalid401{ "error": { "code": "UNAUTHORIZED", ... } }
Valid key, but insufficient permission for the operation403{ "error": { "code": "FORBIDDEN", ... } }
See the full error format in Errors.

​
Best practices

Use environment variables

Load your key from an environment variable or secret manager — never hardcode it in your source.

Rotate on suspected leak

Think your key was compromised? Generate a new one and revoke the old key in the Dashboard.

One key per environment

Keep sandbox and production keys clearly separated in your application.

Restrict in the frontend

In the browser or mobile app, use only the pk. The sk must never leave the server.