Authentication

API apps, key types, restricted keys, and rotation.

API Apps

Watenga uses API apps to manage your keys. Each app has a Client ID and a Secret Key.

You can create multiple apps — one for your website, one for your mobile app, one for WHMCS, etc. Each has independent keys and webhook configuration.

Create and manage apps in your Developer Dashboard at https://dashboard.watenga.africa/developer.

Key Types

Key	Use	Exposure
`Client ID (pk_live_ or pk_test_)`	Browser / frontend (Watenga.js)	Safe to expose publicly
`Secret Key (sk_live_ or sk_test_)`	Server-side API only	Never expose — full account access
`Restricted Key (rk_live_ or rk_test_)`	Limited integrations	Scoped permissions only

Public key — Watenga.js mount:

javascript

const w = Watenga('pk_test_abc123...');

Secret key — server-side API call:

http

Authorization: Bearer sk_test_abc123...

Never expose your Secret Key

Never put your Secret Key in frontend code, browser extensions, or mobile apps. It gives full access to your account.

Restricted Keys

Create restricted keys for integrations that only need specific access. For example, a key that can only read transactions but cannot create payouts.

Create restricted keys in your Developer Dashboard under your API app → Restricted Keys tab.

Resource	No access	Read	Write
Transactions	—	List & view	Create refunds
Payment Links	—	List links	Create & update
Payouts	—	List payouts	Request withdrawal
Webhooks	—	View config	Update URL & events
Account	—	Balance & profile	Update settings

Key Rotation

Regenerate a secret key: Developer Dashboard → API App → Overview → Regenerate Secret Key.

Regenerating immediately invalidates the old key. Update all your integrations before regenerating.

Best practice: rotate keys every 90 days.