Skip to main content
The iMoney Encaissement API is a JSON REST API, available at the base URL https://i-pay.money/api/v1. Except for the single public operation mentioned below, every call authenticates with the secret key of the account matching the target environment, and carries the four common headers described here.

​
Required headers

​
API keys and environments

The dashboard (Développeurs → Clés API, i.e. Developers → API keys) provides a public key and a secret key for each environment: Sandbox and Live are two fully separate accounts, each with its own key pair. A Sandbox key used with Ipay-Target-Environment: live fails with an authentication error (and vice versa): the two environments never silently stand in for each other. Plan for one configuration per environment (same base URL, separate keys and header) rather than a simple boolean switch in your code.

​
Protecting your keys

  • Store the secret key in a secrets manager or a server-side environment variable.
  • Never embed it in front-end JavaScript, a mobile app, a screenshot or a Git repository.
  • Use different keys for Sandbox and Live, and never reuse a Live key in a test environment.
  • After regenerating a key, update the services concerned before removing the old configuration.
  • Log the reference and the HTTP code, but never the Authorization header.

​
Authentication responses

Header checks run in a fixed order on every authenticated operation: the first unmet condition determines the response. The exact order and the literal messages are detailed in Errors. A Sandbox key used with Ipay-Target-Environment: live (or the reverse) is syntactically valid: it fails with 401, not 400.

​
Public operation

Only one operation of this API requires no key and no authentication header: Retrieve a payment link (GET /external_payments/{reference}). Anyone who knows the reference can call it: use a random, high-entropy reference, never a sequential identifier.

​
Webhooks

iMoney Encaissement sends the secret you configured in the Secret-Hash header of its notifications. It is a static shared value, to be compared with your own secret on the server side, not an HMAC signature computed on the request body. The full setup is described in Webhooks.