You generate a dedicated API key for each environment from the Admin Dashboard. You must include this key in the AuthorizationCitizen header of every API call. See Webhook Configuration to set up and verify webhooks.

Generating your API keys

Generate and retrieve your API keys from the Company Settings section of the Admin Dashboard. Each environment has its own key — do not use your sandbox key in production or vice versa.

Region	Environment	Admin Dashboard
EU	Test	`https://test.yaspa.com/#/login`
EU	Live	`https://admin.yaspa.com/#/login`
US	Sandbox	`https://admin-dashboard.sandbox.us.yaspa.com/`
US	Production	`https://admin-dashboard.us.yaspa.com/`

Using your API key

Include the key in the AuthorizationCitizen header on every request:

curl --request POST \
  --url https://api.yaspa.com/v2/payins/hosted-payin/generate-link \
  --header 'AuthorizationCitizen: {your private API key}' \
  --header 'Content-Type: application/json'

Yaspa responds HTTP 403 if the header is missing, incorrect, or from the wrong environment.

Public vs private keys

You generate two types of key per environment:

Private API key (AuthorizationCitizen): authenticates your API calls to Yaspa. Must be kept secret and used only on a secure backend server.
Public API key: appears in webhook request headers (citizen-public-api-key) to identify which merchant Yaspa is notifying. This is not a secret and may appear in client-side contexts.

Keep keys server-side

Never expose your private API key in client-side code, mobile app binaries, browser extensions, or public repositories. All API requests must be made from a secure backend server. Yaspa rejects requests that should not originate from a browser.

If a key is compromised
If your private API key is ever visible in a public repository, browser network tab, or mobile app binary, treat it as compromised and contact Yaspa immediately via your Integration Manager, Customer Success Manager, or the Support section of the Admin Dashboard. Yaspa will rotate the key. There is no self-serve key rotation.

Payout signing keys

Payout instructions require an additional layer of security beyond the API key: an RSA signature generated using a private/public keypair you register with Yaspa. This is entirely separate from the AuthorizationCitizen key. See Payout Security for details.