Skip to content

Authentication

Every request to the NapoleonPay API carries two headers:

HeaderValue
AuthorizationBearer <API_KEY>
SignatureHMAC SHA-256 of the request body, hex-encoded, keyed with your sign key

Two different secrets

You are issued two credentials, and they are not interchangeable:

  • the API key identifies you and goes in the Authorization: Bearer header;
  • the sign key is used only to compute the Signature and is never transmitted.

Signing with the API key by mistake is a common cause of 401.