Documentation

Copy page

Authentication

Every request to the Strictly API must be authenticated using two required credentials:

Header	Type	Description
Authorization	HTTP Basic	Your merchant email and password, Base64-encoded
key-hash	API key (header)	The API key hash issued to your integration

Both headers are required on every request. A missing or invalid credential returns 401 Unauthorized.

---

Authorization header (HTTP Basic)

The Authorization header uses HTTP Basic authentication. Encode your email:password as Base64 and prefix it with Basic .

Generate the token

Terminal
echo -n "your@email.com:yourpassword" | base64
# → eW91ckBlbWFpbC5jb206eW91cnBhc3N3b3Jk

JavaScript
const token = btoa("your@email.com:yourpassword");
// → "eW91ckBlbWFpbC5jb206eW91cnBhc3N3b3Jk"

Python
import base64
token = base64.b64encode("your@email.com:yourpassword".encode()).decode()
# → "eW91ckBlbWFpbC5jb206eW91cnBhc3N3b3Jk"

Then set the header:

Code
Authorization: Basic eW91ckBlbWFpbC5jb206eW91cnBhc3N3b3Jk

---

key-hash header

The key-hash is a static API key unique to your integration. It is passed as a plain header value:

Code
key-hash: YOUR_KEY_HASH_HERE

Contact your account manager to obtain or rotate your key hash.

---

Complete example

cURL (shorthand -u flag)
curl -X GET https://api.paywithzero.net/v1/public/customer/ \
  -u "your@email.com:yourpassword" \
  -H "key-hash: YOUR_KEY_HASH"

JavaScript (fetch)
const response = await fetch(
  "https://api.paywithzero.net/v1/public/customer/",
  {
    headers: {
      Authorization: `Basic ${btoa("your@email.com:yourpassword")}`,
      "key-hash": "YOUR_KEY_HASH",
    },
  }
);

Python (requests)
import requests
from base64 import b64encode

headers = {
    "Authorization": "Basic " + b64encode(b"your@email.com:yourpassword").decode(),
    "key-hash": "YOUR_KEY_HASH",
}

response = requests.get(
    "https://api.paywithzero.net/v1/public/customer/",
    headers=headers,
)

---

Security considerations

:::warning Never expose credentials client-side

Your Authorization credentials and key-hash are server-side secrets. Never include them in client-side JavaScript, mobile apps, or public repositories.

:::

• Always make API calls from your server, not the browser
• Rotate your key hash immediately if it is ever exposed
• Use environment variables to store credentials — never hardcode them

---

Sandbox credentials

For testing, use these demo credentials (see Sandbox & Testing):

Field	Value
Email	integration@strictlyzero.com
Password	demo123*
Key-hash	BL2H6LGNEUGSXTBARA59