Authentication

Base URL#

https://api.niripay.com

Authentication#

All APIs in this document use the same merchant authentication:

Authorization: Bearer YOUR_API_KEY

Keep the API key on your server. Do not expose it in browser code, mobile applications, screenshots, logs, or public repositories.

IP whitelist#

Add every production server egress IP to the merchant dashboard under API Key & IP Whitelist. Requests from an IP that is not allowed are rejected even when the API key is valid.

Request formats#

• JSON APIs use Content-Type: application/json.
• File upload APIs use multipart/form-data.
• When using FormData or a multipart HTTP library, let the client generate the multipart boundary. Do not set the Content-Type boundary manually.
• Always inspect the response body's status field. Some business and validation errors use HTTP 200 with "status": "error".

Common response envelope#

Success:

{
  "status": "success",
  "message": "Human-readable result",
  "data": {}
}

Error:

{
  "status": "error",
  "message": "Description of the problem"
}

Server-side request helper#

The JavaScript snippets in the API reference use this helper. Configure NIRIPAY_API_KEY in your server environment.

const BASE_URL = "https://api.niripay.com";
const API_KEY = process.env.NIRIPAY_API_KEY;

async function niripayJson(path, body) {
  const response = await fetch(`${BASE_URL}${path}`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${API_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify(body)
  });

  const result = await response.json();

  if (!response.ok || result.status !== "success") {
    throw new Error(result.message || `NiriPay request failed (${response.status})`);
  }

  return result;
}