API keys & authentication.

Overview

Every API request to Reevit must be authenticated with a secret key. This guide covers how to generate keys, authenticate requests, set up webhooks, and follow security best practices.

API key types

Reevit provides two key pairs, one for each mode:

Generate your API keys

1. 1

   Go to Developers → API Keys

   Mark as doneDoneMark step 1 as done

   From your dashboard, navigate to Developers → API Keys tab. You'll see your sandbox keys immediately.

2. 2

   Copy your sandbox keys

   Mark as doneDoneMark step 2 as done

   Click the copy icon next to your sandbox secret key. This is what you'll use for all API calls during development.

3. 3

   Generate live keys (when ready)

   Mark as doneDoneMark step 3 as done

   Live keys require KYC approval. Once your organization is verified, click Generate Live Keys to create your production credentials.

   You can build your entire integration with sandbox keys. The API surface is identical. Only switch to live keys when you're ready to process real money.

Authenticate API requests

Include your secret key in the Authorization header:

curl -X GET https://sandbox-api.reevit.io/v1/payments \  -H "Authorization: Bearer sk_sandbox_your_key_here" \  -H "Content-Type: application/json"

All API endpoints follow the same pattern:

• Sandbox: https://sandbox-api.reevit.io/v1/...
• Live: https://api.reevit.io/v1/...

Idempotency

For POST requests that create resources (payments, refunds, subscriptions), include an idempotency key to prevent duplicate operations:

curl -X POST https://sandbox-api.reevit.io/v1/payments \  -H "Authorization: Bearer sk_sandbox_your_key_here" \  -H "X-Idempotency-Key: unique-request-id-abc123" \  -H "Content-Type: application/json" \  -d '{ "amount": 5000, "currency": "GHS" }'

If you retry the same request with the same idempotency key, Reevit returns the original response instead of creating a duplicate.

Configure webhooks

1. 4

   Go to Developers → Webhooks

   Mark as doneDoneMark step 4 as done

   Navigate to Developers → Webhooks tab in your dashboard.

2. 5

   Add an endpoint

   Mark as doneDoneMark step 5 as done

   Click Add Endpoint and enter your webhook URL. Choose which events to subscribe to:

   • payment.succeeded
   • payment.failed
   • payment.refunded
   • subscription.created
   • subscription.canceled
   • payment_link.paid
3. 6

   Verify webhook signatures

   Mark as doneDoneMark step 6 as done

   Every webhook includes a signature in the X-Reevit-Signature header. Verify it to ensure the webhook came from Reevit:

   ExamplejavascriptCopy

   const crypto = require('crypto'); function verifyWebhook(payload, signature, secret) {  const expected = crypto    .createHmac('sha256', secret)    .update(payload)    .digest('hex');  return crypto.timingSafeEqual(    Buffer.from(signature),    Buffer.from(expected)  );}

Rate limits

Rate-limited responses return HTTP 429 with a Retry-After header.

Next steps