Generate a API key for your Paytia account and activate tokens
Note: this is a licenced service adding enhanced security through the use of access tokens and pre-authorisation before making your API post request.
The Paytia service requires API keys to be generated if your business or developers are integrating new services to Paytia merchant accounts.
The API key specifies the merchant account on the Paytia platform that an application will utilise when sending data to Paytia.
The API key is a licenced product and when active allows the Paytia customer to generate their own API keys from their Paytia administrative console.
API Secret Key
The API key is generated in the
Account security > API secret key sub-menu
Adding the API settings
You can choose to restrict access to your account by IP address as well as API key.
All you need to do is pick the webhook settings output type
Single JSON data - this will give the output as one string of data
Multiple JSON data - this will separate each field sent as a new line of data in the JSON (Worldpay Corporate Gateway only)
Now click Save to activate your API key and settings on your account.
You will see your KEY is saved and active.
You will now see you have an additional Button in your Action column. This is for 'Generate tokens'.
If you click the 'Generate tokens' button you will see you have access keys.
To activate the service use the radio slider set to Green = ON
Now copy the Client ID and Client Secret. You will use these values with a new Paytia API pre-authorisation API service.
NOTE: The ‘client_id’ is a public identifier for apps. It must also be unique across all Paytia client API connections that our authorization server handles. Even though it’s public, the 32-character hex string is complex for added security.
NOTE: The ‘client_secret’ is a secret value known only to the application and the authorization server. It must be sufficiently random to not be guessable, you should, therefore, avoid using common UUID libraries which often take into account the timestamp or MAC address of the server generating it.
NOTE: The ‘access_token’ will be generated from your authorisation POST of the Client ID & Client Secret pair (in raw JSON format). This will be a time-limited token with auto expiry in one hour from key generation. The ‘access_token’ will be used to further authenticate the API requests made into Paytia.
NOTE: ‘refresh_token’ will be generated from your authorisation POST of the Client ID & Client Secret pair (in raw JSON format). The ‘refresh_token’ will be used to generate a new ‘access_token’ when the token expires. The ‘refresh_token’ will then be regenerated and returned with each ‘access_token’ creation to allow continued renewals of secure credentials to be generated.
The new API URL endpoint your will post to is /api/authorize
Example post
curl
--location
'https://accounts.paytia.com/api/authorize--header 'X-API-KEY: 10ccd130aab3511a72b0a8fb68ae5e21d45c1392d671c65f04973c238495dd344' \
--header 'Cookie: ci_session=19johr4r63q758b60cigskiqvj4qtkeu' \
--form 'client_id="hgCHZzsrsBpDZFwzEzDNSdEsApP1qwa86NxVswjfM0IA="' \
--form 'client_secret="z/FZZiK0ouEE/AbUZWrNZjyRksNF8lZ3MioI9nCyQrADS="' \
--form 'refresh_token="elkLoWa38yuzgCNMXmBxgQ6//cU+M2Grkjd1nuHy0aYAA="'
Like all Paytia API's you will send a post request including your X-API-KEY value as a header field
In the body of the post you will send the client_id, client_secret values
When you post in, Paytia will send you a refresh token you can use in future posts to refresh the access session.