> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beem.africa/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate Bpay Collection API requests using Basic Auth or an access token.

Bpay Collection API requests (such as balance checks) require authentication. Use **HTTP Basic Authentication** (API Key and Secret) or pass an **access token** in the `Authorization` header.

Use one method per request — not both.

<Info>
  Payment collection **callbacks** are inbound webhooks from Bpay to your server — they do not use your API credentials. See [Callbacks](/guides/payments-collection/callbacks).
</Info>

***

## Generate credentials

API Key and Secret are available from **BPAY → API Setup** in the Beem dashboard.

<Warning>
  Your API Secret is displayed **only once**. Store it securely, as it cannot be viewed again.
</Warning>

***

## Authentication methods

<Tabs>
  <Tab title="API Key & Secret">
    | Header          | Value                              |
    | --------------- | ---------------------------------- |
    | `Authorization` | `Basic base64(api_key:secret_key)` |
    | `Content-Type`  | `application/json`                 |

    * **Username:** API Key
    * **Password:** API Secret

    ```http theme={null}
    GET /v1/credit-balance?app_name=BPAY HTTP/1.1
    Host: apitopup.beem.africa
    Authorization: Basic <base64-encoded-api_key:secret_key>
    Content-Type: application/json
    ```
  </Tab>

  <Tab title="Access Token">
    | Header          | Value              |
    | --------------- | ------------------ |
    | `Authorization` | `<access-token>`   |
    | `Content-Type`  | `application/json` |

    Pass your access token directly — **do not** use a `Bearer` prefix.

    ```http theme={null}
    GET /v1/credit-balance?app_name=BPAY HTTP/1.1
    Host: apitopup.beem.africa
    Authorization: <access-token>
    Content-Type: application/json
    ```
  </Tab>
</Tabs>

<Warning>
  Never expose your API Key, API Secret, or access token in frontend applications or public repositories.
</Warning>

***

## Authentication errors

| HTTP Status | Code  | Message                           |
| ----------- | ----- | --------------------------------- |
| `401`       | `120` | Invalid Authentication Parameters |
| `400`       | —     | No authorization headers          |