Authentication

Every API request is authenticated with a Bearer API key in the Authorization header. There is no separate login step and no OAuth flow.

Authorization: Bearer DEV-xxxxxxxxxxxxxxxxxxxxxxxx

Your four credentials

Each merchant has two key pairs — one for the sandbox, one for production:

Credential	Prefix	Secret?	Role
Sandbox API key	DEV-	Semi — sent as a Bearer token	Authenticates sandbox requests.
Sandbox private key	devsk-	Yes — never sent	Signs sandbox requests & callbacks.
Production API key	PROD-	Semi — sent as a Bearer token	Authenticates production requests.
Production private key	prodsk-	Yes — never sent	Signs production requests & callbacks.

Your merchant code (e.g. M0001) is not secret — it is part of the request signature and identifies your account.

The environment is chosen by your key

There is a single base URL: https://payment.incognito.asia/api/v1. You do not switch hosts between sandbox and production. Instead:

• Authenticate with your DEV- key → the request runs in the sandbox. Transactions get a DEV- reference prefix and can only be settled with simulate-pay.
• Authenticate with your PROD- key → the request runs in production against the real BCA account.

Why this matters

Sandbox and production have separate unique-code pools. A sandbox test can never accidentally settle — or collide with — a real invoice, and vice-versa.

Example request

cURL

curl -s https://payment.incognito.asia/api/v1/payment-channels \
  -H "Authorization: Bearer $INCOGNITO_PAYMENTS_API_KEY"

Node.js

const payments = new IncognitoPayments({
  apiKey: process.env.INCOGNITO_PAYMENTS_API_KEY!,
  privateKey: process.env.INCOGNITO_PAYMENTS_PRIVATE_KEY!,
  merchantCode: "M0001",
});
await payments.paymentChannels();

PHP / Laravel

$payments = new PaymentClient([
    'api_key'       => env('INCOGNITO_PAYMENTS_API_KEY'),
    'private_key'   => env('INCOGNITO_PAYMENTS_PRIVATE_KEY'),
    'merchant_code' => 'M0001',
]);
$payments->paymentChannels();

Authentication errors

Situation	HTTP	Body
No/malformed Authorization header	401	{"success": false, "message": "Invalid or inactive API key."}
Unknown key, or merchant deactivated	401	{"success": false, "message": "Invalid or inactive API key."}
Sandbox-only action with a PROD- key	403	{"success": false, "message": "Use your sandbox API key to simulate a payment."}

Rotating keys

Keys can be regenerated from the merchant dashboard, one environment at a time or both at once. Regenerating invalidates the old keys immediately, so update your server’s environment variables in the same deploy.

Store keys in environment variables

Never hard-code keys. Read them from INCOGNITO_PAYMENTS_API_KEY, INCOGNITO_PAYMENTS_PRIVATE_KEY, and INCOGNITO_PAYMENTS_MERCHANT_CODE. Both SDKs are built to pick these up.