API authentication
API authentication is the process by which a payment infrastructure provider verifies that an API request is submitted by an authorized caller, typically through API keys, OAuth access tokens, or HMAC signatures. This ensures that only legitimate applications can initiate payment operations and access sensitive financial data.
Payment APIs handle sensitive financial operations and data: initiating money transfers, issuing card credentials, accessing account balances. Strong authentication is non-negotiable. Without it, any entity could call the API and initiate payments, access cardholder data, or disrupt operations. Authentication mechanisms range from simple API keys to sophisticated mutual TLS and OAuth flows.
API keys are the most common authentication mechanism for server-to-server payment API integration. Each client receives a unique key that must be included in every API request header. The server validates the key against its registry before processing the request. API keys must be stored securely, never in client-side code, public repositories, or unencrypted logs.
For webhook authentication, HMAC (Hash-based Message Authentication Code) signatures are used in addition to API keys. When Nium sends a webhook, it includes a signature generated from the webhook payload and a shared secret. The client verifies the signature to confirm the webhook is genuine and unmodified, preventing webhook injection attacks where malicious actors attempt to trigger payment operations by sending fake webhook events.
API authentication protects against unauthorized access to payment operations and financial data. A compromised API key could enable an attacker to initiate fraudulent payments, access sensitive cardholder information, or disrupt card programs. Proper authentication implementation, including secure key storage, regular rotation, and least-privilege scoping, is a fundamental security requirement for any production payment integration.
- API keys must be stored securely and rotated regularly
- Shared API key environments require careful access control to prevent internal misuse
- OAuth token management adds complexity for user-delegated access use cases
- HMAC signature verification is often not implemented, leaving webhooks vulnerable
- Test and production API keys must be strictly segregated to prevent test operations reaching production systems
A fintech discovers its staging environment API key has been inadvertently committed to a public GitHub repository. Because Nium's platform supports API key scoping (the staging key only has access to non-production environments) and instant key revocation, the company revokes the exposed key within 10 minutes of discovery and generates a replacement, with zero exposure of production payment operations or cardholder data.
Related Concepts
Nium's API platform uses API key authentication for server-to-server integrations, with OAuth 2.0 support for user-delegated access flows. Nium's webhook deliveries include HMAC signatures for payload verification. Nium provides API key management tools including scope configuration, usage monitoring, and instant revocation.
Answers you didn't know you needed.
What is an API key?
An API key is a unique identifier, a long random string, that an application includes in its API requests to prove its identity. API keys should be treated as passwords: stored securely, never exposed publicly, and rotated regularly.
Where should API keys be stored?
API keys should be stored in environment variables or secrets management systems (AWS Secrets Manager, HashiCorp Vault). They should never be hard-coded in application code, committed to version control repositories, or included in client-side JavaScript.
What is the difference between API key authentication and OAuth?
API key authentication identifies the application making the request. OAuth authorizes the application to act on behalf of a specific user. Use API keys for server-to-server platform integration; use OAuth when individual user authorization is required.
What is HMAC signature verification?
HMAC (Hash-based Message Authentication Code) is a cryptographic technique for verifying message authenticity. Nium signs webhook payloads with a HMAC using a shared secret. Clients verify the signature to confirm the webhook is genuine and unmodified before processing.
How should I manage API keys for multiple environments?
Use separate API keys for development, staging, and production environments. Configure key scopes to restrict staging keys from accessing production resources. Store all keys in a secrets management system rather than in configuration files.