Authentication

All Bpay Checkout API requests require authentication. Use HTTP Basic Authentication (API Key and Secret) or pass an access token in the Authorization header. Use one method per request — not both.

Checkout callbacks are inbound webhooks from Bpay to your server. They may include an optional beem-secure-token header you supplied in the original request — not your API credentials. See Callbacks.

Generate credentials

API Key and Secret are available from BPAY → API Setup in the Beem dashboard.

Your API Secret is displayed only once. Store it securely, as it cannot be viewed again.

Authentication methods

API Key & Secret
Access Token

Header	Value
`Authorization`	`Basic base64(api_key:secret_key)`
`Content-Type`	`application/json`

Username: API Key
Password: API Secret

Optional header for checkout requests:

Header	Description
`beem-secure-token`	Client validation token — returned in callback headers

GET /v1/checkout?amount=1200&reference_number=SAMPLE-12345&transaction_id=96f9cc09-afa0-40cf-928a-d7e2b27b2408 HTTP/1.1
Host: checkout.beem.africa
Authorization: Basic <base64-encoded-api_key:secret_key>
Content-Type: application/json
beem-secure-token: <secure-token>

Header	Value
`Authorization`	`<access-token>`
`Content-Type`	`application/json`

Pass your access token directly — do not use a Bearer prefix.

GET /v1/checkout?amount=1200&reference_number=SAMPLE-12345&transaction_id=96f9cc09-afa0-40cf-928a-d7e2b27b2408 HTTP/1.1
Host: checkout.beem.africa
Authorization: <access-token>
Content-Type: application/json
beem-secure-token: <secure-token>

Never expose your API Key, API Secret, or access token in frontend applications or public repositories.

Authentication errors

HTTP Status	Code	Message
`401`	`120`	Invalid Authentication Parameters
`400`	—	No authorization headers

See Error codes for additional checkout errors.

Getting Started

APIs

Generate credentials

Authentication methods

Authentication errors

​Generate credentials

​Authentication methods

​Authentication errors

Generate credentials

Authentication methods

Authentication errors