Skip to main content

Authentication

Every request must be authenticated. This takes seconds to set up. Two separate authentication layers exist: Your application never uses your console password. It uses an API key you generate inside the console.

Step 1 — Create your account

Register at console.palpluss.com. After email verification and KYC approval your account is active.
KYC is required before initiating live STK Push or B2C transactions. You can generate API keys and test immediately after registration.

Step 2 — Generate an API key

  1. Log in to console.palpluss.com
  2. Go to Settings → API Keys
  3. Click Create API Key, name it, and select the required scopes
  4. Copy the key — it is shown only once
Store your API key in environment variables or a secrets manager — never in source code or version control. Revoke and reissue immediately if compromised.

Step 3 — Authenticate requests

Set your API key as the Basic Auth username. Leave the password empty.
Trying endpoints from these docs? The API playground shows two fields: paste your API key into the username field and leave the password field empty — it is ignored by PalPluss. That’s it, you can copy-paste and send requests directly.
Note the trailing colon — it encodes an empty password. Most HTTP clients handle this automatically.

How it works

  1. Send Authorization: Basic <base64(key:)> on every request
  2. PalPluss decodes the header and looks up the key
  3. Valid key + active account → request proceeds
  4. Invalid, revoked, or suspended → 401

API key scopes

Use the minimum scopes your integration needs.

Authentication errors


Rate limiting

60 requests per minute per API key. Every response includes:

Key rotation

  • Create first, then revoke — update your application before revoking the old key. Revoking first causes downtime.
  • One key per environment — separate keys for development, staging, and production.
  • One key per service — revoke one without affecting others.
  • Rotate regularly — every 90 days at minimum; immediately if a key is exposed.
  • Audit periodically — revoke keys that are no longer in use.