Authentication

All merchant-facing PayBridgeNP API endpoints require a Bearer API key in the Authorization header:

Authorization: Bearer sk_test_your_key_here

Getting your API keys

Key prefixes

Prefix	Mode	Use
`sk_test_`	Sandbox	eSewa and Khalti test flows; see the Fonepay warning below
`sk_live_`	Live	Production - real payments

The mode is fixed per key. A sandbox key creates sandbox records; a live key creates live payments.

Fonepay has no sandbox. If Fonepay is enabled on a sandbox project, it uses your real Fonepay merchant account and moves real money. The sandbox caps are NPR 1,000 per payment and NPR 5,000 per month. See Sandbox testing.

Never expose a secret API key in client-side code, browser JavaScript, or version control. Use server-side environment variables only.

Example request

curl https://api.paybridgenp.com/v1/payments \
  -H "Authorization: Bearer sk_test_your_key"

Authentication errors

When authentication fails, the response body always includes a code field so your integration can branch on the failure mode without parsing human-readable messages.

`code`	HTTP	When it fires
`api_key_missing`	401	No `Authorization: Bearer ...` header, or the key portion is empty.
`api_key_invalid`	401	Key not recognized - typo, deleted project, or wrong environment.
`api_key_revoked`	401	Key was explicitly revoked from the dashboard. Generate a new one.
`api_key_expired`	401	Key passed its expiration timestamp.
`api_key_must_be_secret`	403	Endpoint requires `sk_...`; a publishable `pk_...` key was sent.
`account_suspended`	403	Merchant account suspended. See `suspended_at` + `suspended_reason` in the body.

Example invalid-key response:

{
  "error": {
    "message": "Invalid API key. Verify the key in your dashboard at https://dashboard.paybridgenp.com.",
    "type": "authentication_error",
    "code": "api_key_invalid",
    "request_id": "req_2Je91NlWKuXkdXUJOK9gaHNW"
  }
}

Account suspended

If your merchant account has been suspended by PayBridgeNP, all API key requests return:

{
  "error": {
    "message": "This merchant account has been suspended. Contact support@paybridgenp.com to resolve.",
    "type": "account_error",
    "code": "account_suspended",
    "request_id": "req_...",
    "suspension": {
      "suspended_at": "2026-04-20T10:00:00.000Z",
      "reason": "Violation of terms of service"
    }
  }
}

HTTP status: 403 Forbidden Your API keys, checkout sessions, and hosted payment pages will all be blocked until the suspension is lifted. Contact support@paybridgenp.com to resolve.

Rotating keys

You can generate a new API key from the dashboard at any time. Old keys remain valid until you revoke them. Revoke a key immediately if it’s been exposed.

Overview

Checkout

Payment Links

Payments

Direct QR

Refunds

Webhooks

Account

Billing

Analytics

Providers

SMS

Getting your API keys

Key prefixes

Example request

Authentication errors

Account suspended

Rotating keys

​Getting your API keys

​Key prefixes

​Example request

​Authentication errors

​Account suspended

​Rotating keys

Getting your API keys

Key prefixes

Example request

Authentication errors

Account suspended

Rotating keys