Skip to main content
API keys are used to authenticate requests, typically provided as an Authorization header. Your keys are used to identify the account on our platform, and carries many privileges, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as public source code repositories, client-side code, and so forth. All API requests must be made over HTTPS. Calls made over plain HTTP will fail. API requests:
  • without authentication will return an unauthorized error
  • without a valid key will return an invalid request error
  • with a deleted or expired key will return a forbidden error

​
Operating Modes

The Moment APIs support two modes of operation: Test Mode and Live Mode.
Each mode is associated with a unique pair of API keys — a Secret Key and a Public Key — resulting in a total of four keys per account.
  1. Live Mode – In this mode, real funds are transferred. Use it only in production environments.
  2. Test Mode – No actual funds are transferred in this mode. It is intended solely for development, testing, and integration purposes.

​
API Keys

Every API request must include the Authorization header with your API key as a bearer token:

The API key will be either a secret key or a public key, as described below:
To keep your account safe, we recommend you:
  • Rotate keys regularly to enhance security.
  • Revoke compromised keys immediately.

New keys can be requested from the customer success team as needed.

​
Business Units

An API key is issued against your organisation and is linked to one or more business units. The business unit determines which processing account a request belongs to, and every transaction and settlement is scoped to it. If your key is linked to more than one business unit, every request must name the one it applies to using the Moment-Business-Unit header:
If your key is linked to exactly one business unit, the header can be omitted and that business unit is used. Business unit identifiers are prefixed with bu_ and can be found in the Client Portal. Requests that omit the header on a multi business unit key, or that send an identifier the key is not linked to, are rejected. See business unit errors for the exact responses.
The header selects which business unit to act on. It does not grant access. A key can only ever act on the business units it is already linked to.