# Authentication

## Base URL

```text
https://api.niripay.com
```

## Authentication

All APIs in this document use the same merchant authentication:

```http
Authorization: Bearer YOUR_API_KEY
```

Keep the API key on your server. Do not expose it in browser code, mobile applications, screenshots, logs, or public repositories.

## IP whitelist

Add every production server egress IP to the merchant dashboard under **API Key & IP Whitelist**. Requests from an IP that is not allowed are rejected even when the API key is valid.

## Request formats

- JSON APIs use `Content-Type: application/json`.
- File upload APIs use `multipart/form-data`.
- When using `FormData` or a multipart HTTP library, let the client generate the multipart boundary. Do not set the `Content-Type` boundary manually.
- Always inspect the response body's `status` field. Some business and validation errors use HTTP `200` with `"status": "error"`.

## Common response envelope

Success:

```json
{
  "status": "success",
  "message": "Human-readable result",
  "data": {}
}
```

Error:

```json
{
  "status": "error",
  "message": "Description of the problem"
}
```



## Server-side request helper

The JavaScript snippets in the API reference use this helper. Configure `NIRIPAY_API_KEY` in your server environment.



```js
const BASE_URL = "https://api.niripay.com";
const API_KEY = process.env.NIRIPAY_API_KEY;

async function niripayJson(path, body) {
  const response = await fetch(`${BASE_URL}${path}`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${API_KEY}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify(body)
  });

  const result = await response.json();

  if (!response.ok || result.status !== "success") {
    throw new Error(result.message || `NiriPay request failed (${response.status})`);
  }

  return result;
}
```