Authentication
All requests require your API key in the X-Api-Key header.
API keys are scoped — each key only grants access to the endpoints listed in its scope. Keys are managed through the Regini partner portal.
Keep your API key secret
Rotate it immediately if you believe it has been compromised. Never expose it in client-side code or mobile apps.
Scopes
| Scope | Grants access to |
|---|---|
accounts:read |
GET /accounts, GET /accounts/{id}, GET /accounts/{id}/balance |
accounts:write |
POST /accounts |
transactions:read |
GET /accounts/{id}/transactions, GET /transactions/{id} |
transactions:create |
Quote and initiate deposits and withdrawals |
compliance:read |
GET /accounts/{id}/compliance |
Sandbox vs. live
| Key prefix | Environment | Behaviour |
|---|---|---|
rk_live_<key> |
Production | Real M-Pesa flows and Kotani calls |
rk_test_<key> |
Sandbox | Immediate success responses, no real money moves |
See Sandbox for details.