Authentication

Overview

All protected Daya API requests require authentication using API keys. Each key is tied to a specific merchant and environment (Sandbox or Production).

API keys grant full access to your account. Never share them publicly or commit them to version control.

API Keys

Generating Keys

Sign up at dashboard.daya.co
Navigate to API Keys
Generate separate keys for Sandbox and Production

Key Format

Environment	Prefix	Example
Sandbox	`sk_sandbox_`	`sk_sandbox_abc123...`
Production	`sk_live_`	`sk_live_xyz789...`

Environments

Environment	Purpose	Base URL
Sandbox	Testing with fake funds	`https://api.sandbox.daya.co`
Production	Live transactions with real money	`https://api.daya.co`

Sandbox and Production environments are completely isolated. Data and keys do not cross environments.

Making Authenticated Requests

Include your API key in the X-Api-Key header on every protected request:

curl --request GET \
  --url https://api.daya.co/v1/rates \
  --header 'X-Api-Key: YOUR_API_KEY'

const response = await fetch('https://api.daya.co/v1/rates', {
  headers: {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json'
  }
});

import requests

headers = {
    'X-Api-Key': 'YOUR_API_KEY',
    'Content-Type': 'application/json'
}
response = requests.get('https://api.daya.co/v1/rates', headers=headers)

client := &http.Client{}
req, _ := http.NewRequest("GET", "https://api.daya.co/v1/rates", nil)
req.Header.Add("X-Api-Key", "YOUR_API_KEY")
req.Header.Add("Content-Type", "application/json")
resp, _ := client.Do(req)

Idempotent Write Requests

Endpoints that create resources, such as POST /v1/funding-accounts, POST /v1/transfers, and POST /v1/merchant/withdrawals, also require an X-Idempotency-Key header. Use a new value for each new write attempt, and reuse the same value only when retrying the exact same request.

cURL

curl --request POST \
  --url https://api.daya.co/v1/funding-accounts \
  --header 'X-Api-Key: YOUR_API_KEY' \
  --header 'X-Idempotency-Key: funding-account-20260320-0001' \
  --header 'Content-Type: application/json'

Environment Isolation

Sandbox
Production

For: Integration testing, developmentCharacteristics:

Separate API keys from production
Simulated NGN deposits
Testnet USDC/USDT (no real value)
Same API surface as production
No KYB required

Use when: Building and testing your integration

Never use production keys in sandbox or vice versa. The API will reject cross-environment requests.

Security Best Practices

Store keys securely

Use environment variables or secret management systems (AWS Secrets Manager, HashiCorp Vault)
Never hardcode keys in source code
Never commit keys to Git repositories

.env

DAYA_SANDBOX_KEY=sk_sandbox_abc123...
DAYA_PRODUCTION_KEY=sk_live_xyz789...

Rotate keys regularly

Rotate API keys every 90 days or immediately if compromised:

Generate new key in dashboard
Update your application configuration
Verify new key works
Delete old key

Implement rate limiting

Implement client-side rate limiting to avoid hitting API limits:

100 requests per minute per key
1,000 funding account creations per day (see Limits)

Error Responses

401 Unauthorized

Missing or invalid API key:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key",
    "details": "Ensure the X-Api-Key header is present and contains a valid API key"
  }
}

Common causes:

Missing X-Api-Key header
Empty or malformed API key value
Invalid or revoked API key
Using sandbox key with production URL (or vice versa)

403 Forbidden

Merchant account frozen or suspended:

{
  "error": {
    "code": "merchant_frozen",
    "message": "Merchant account is frozen",
    "details": "Contact support@daya.co for assistance"
  }
}

Why merchants are frozen:

Exceeded funding account creation limit (1,000/day)
Risk or compliance review triggered
Manual suspension by operations

If your merchant account is frozen, new funding accounts, FX conversions, transfers, and withdrawals are blocked. Contact support for resolution.

Webhook Authentication

Webhooks use HMAC-SHA256 signatures, not API keys. See Webhook Verification.

Testing Authentication

Verify your API key works:

curl --request GET \
  --url https://api.sandbox.daya.co/v1/rates?from=NGN \
  --header 'X-Api-Key: YOUR_SANDBOX_KEY'

// Test authentication
async function testAuth() {
  const response = await fetch(
    'https://api.sandbox.daya.co/v1/rates?from=NGN',
    {
      headers: { 'X-Api-Key': 'YOUR_SANDBOX_KEY' }
    }
  );

  if (response.ok) {
    console.log('Authentication successful');
  } else {
    console.error('Authentication failed:', response.status);
  }
}

Expected response (if successful):

{
  "rate_id": "rate_abc123",
  "from": "NGN",
  "to": "USDC",
  "rate": 1545.50,
  ...
}

Getting Started

Core Concepts

Guides

Rates & Chains

Customers

Funding Accounts

Transfers

Deposits

Recipients

Banks

USD Virtual Accounts

USD Virtual Account Deposits

Merchant Balance

Merchant Funding

Webhooks

Legacy API

Overview

API Keys

Generating Keys

Key Format

Environments

Making Authenticated Requests

Idempotent Write Requests

Environment Isolation

Security Best Practices

Error Responses

401 Unauthorized

403 Forbidden

Webhook Authentication

Testing Authentication

Next Steps

Core Concepts

Quick Start

​Overview

​API Keys

​Generating Keys

​Key Format

​Environments

​Making Authenticated Requests

​Idempotent Write Requests

​Environment Isolation

​Security Best Practices

​Error Responses

​401 Unauthorized

​403 Forbidden

​Webhook Authentication

​Testing Authentication

​Next Steps

Core Concepts

Quick Start

Overview

API Keys

Generating Keys

Key Format

Environments

Making Authenticated Requests

Idempotent Write Requests

Environment Isolation

Security Best Practices

Error Responses

401 Unauthorized

403 Forbidden

Webhook Authentication

Testing Authentication

Next Steps