Live Pay

LivePay

Authentication

Secure authentication for API access and user verification

Overview

The LivePay system uses Bearer token authentication with dual-key security. All API requests require both a Secret Key in the Authorization header and a Public Key in the request body for enhanced security.

How It Works

The system validates your Secret Key from the Authorization header and matches it with your Public Key in the request body. Both keys must be valid and the account must be active for successful authentication.

Base URL

API Endpoint

All API requests should be made to this base URL

Base URL
https://livepay.me/api/v1

Example Endpoints

Request Money: /deposit
Send Money: /withdraw
Get Transactions: /transactions
Check Balance: /user-balance.php
Check Status: /transaction-status.php

Authentication Flow

1. Header Validation

Extract Bearer token from Authorization header and validate Secret Key

2. User Verification

Check user status, API access, and account activation status

3. Public Key Match

Validate Public Key in request body matches the user's stored key

Implementation Details

Component Location Purpose Validation
Secret Key Authorization Header Primary user identification Required
Public Key Request Body Secondary verification Required
User Status System Check Account activation status Required
API Status System Check API access permission Required

Error Responses

HTTP Status Error Code Message Description
401 AUTH_001 Missing or invalid Authorization header Bearer token not provided or malformed
401 AUTH_002 Invalid Secret Key Secret key not found in system
401 AUTH_003 Invalid user public key Public key in body doesn't match stored key
401 AUTH_004 API access is turned off by user User has disabled API access
401 AUTH_005 Account inactive - submit KYC User account requires KYC verification
403 AUTH_006 API access turned off by admin Global API access is disabled

Security Best Practices

Key Management

  • Store Secret Keys securely - never expose in client-side code
  • Rotate keys regularly for enhanced security
  • Use environment variables for key storage

Request Security

  • Always use HTTPS for API requests
  • Validate all input parameters server-side
  • Implement rate limiting to prevent abuse