Authentication

API Key Authentication

CWMPay uses API keys to authenticate requests. Every request to the CWMPay API must include your API key in the request header.

x-api-key: YOUR_API_KEY

Getting Your API Key

Login to app.cwmpay.in
Navigate to API Keys section from the sidebar
Click Generate API Key if not generated
Copy and store your key securely

Using Your API Key

Pass your API key in the x-api-key header with every request:

curl -X POST https://api.cwmpay.in/api/merchant/{payment}/create \ // ({payment} here can be either "inr" or "crypto")
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Best Practices

Store in Environment Variables

Never hardcode your API key in your source code. Always use environment variables:

    # .env file
    CWMPAY_API_KEY=your_api_key_here

    // Usage in code
    const apiKey = process.env.CWMPAY_API_KEY;

Never Expose in Frontend

API keys must only be used server-side. Never include your API key in:

Frontend JavaScript code
Mobile app source code
Public GitHub repositories
Browser requests

Always make CWMPay API calls from your backend server.

Regenerate if Compromised

If you suspect your API key has been compromised:

Go to API Keys in your dashboard
Click Regenerate Key
Update your environment variables immediately
Old key will be invalidated instantly

Error Responses

If authentication fails, you’ll receive one of these responses:

Status	Message	Reason
`401`	API key required	`x-api-key` header missing
`401`	Invalid API key	Key does not exist or is invalid

Get Started

INR Payments

Webhooks

Help

Authentication

API Key Authentication

Getting Your API Key

Using Your API Key

Best Practices

Error Responses

Next Steps

Create Payment

Webhooks

​API Key Authentication

​Getting Your API Key

​Using Your API Key

​Best Practices

​Error Responses

​Next Steps

Create Payment

Webhooks

API Key Authentication

Getting Your API Key

Using Your API Key

Best Practices

Error Responses

Next Steps