Authentication
Every request must be authenticated. This takes seconds to set up. Two separate authentication layers exist:
Your application never uses your console password. It uses an API key you generate inside the console.
Step 1 — Create your account
Register at console.palpluss.com. After email verification and KYC approval your account is active.KYC is required before initiating live STK Push or B2C transactions. You can generate API keys and test immediately after registration.
Step 2 — Generate an API key
- Log in to console.palpluss.com
- Go to Settings → API Keys
- Click Create API Key, name it, and select the required scopes
- Copy the key — it is shown only once
Step 3 — Authenticate requests
Set your API key as the Basic Auth username. Leave the password empty.How it works
- Send
Authorization: Basic <base64(key:)>on every request - PalPluss decodes the header and looks up the key
- Valid key + active account → request proceeds
- Invalid, revoked, or suspended →
401
API key scopes
Use the minimum scopes your integration needs.
Authentication errors
Rate limiting
60 requests per minute per API key. Every response includes:Key rotation
- Create first, then revoke — update your application before revoking the old key. Revoking first causes downtime.
- One key per environment — separate keys for development, staging, and production.
- One key per service — revoke one without affecting others.
- Rotate regularly — every 90 days at minimum; immediately if a key is exposed.
- Audit periodically — revoke keys that are no longer in use.