Authentication
Send your secret key as a bearer token on every request:
curl https://api.kibanda.africa/v1/shop -H "Authorization: Bearer kb_live_..."
- One key = one shop. Everything you read or write is scoped to the shop that made the key.
- Test and live are separate.
kb_test_…keys only work onapi-staging.kibanda.africa;kb_live_…keys only onapi.kibanda.africa. Using one on the other returnsapi_key_wrong_environment. - Shown once. We store only a hash. If you lose a key, create a new one and revoke the old one.
- Create and revoke keys in the dashboard (Developers → API keys). An API key can't create or list keys.
- Server-side only. Never put a secret key in a browser, mobile app, or a WhatsApp message. If one leaks, revoke it at once; requests with a revoked key fail immediately.
Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | unauthenticated |
No Authorization header. |
| 401 | api_key_invalid |
Malformed, unknown or revoked key. |
| 401 | api_key_wrong_environment |
A test key on production, or a live key on staging. |
| 403 | session_required |
The endpoint is dashboard-only (API key management). |