Which key should I use with the REST API?
The secret key of the target environment, inAuthorization: Bearer. It must stay on the server side. Details: Authentication.
Can I use a Sandbox key with the Live environment?
No. The key must belong to the same environment asIpay-Target-Environment. Details: Authentication and Getting started.
How do I know whether a payment really succeeded?
Check on the server side thatGET /api/v1/payments/{reference} returns status: succeeded, or process an authenticated webhook and then confirm the status if the action is sensitive. Details: Retrieve a transaction.
Can I reuse transaction_id?
No: this external reference must be unique for your account, and a duplicate returns 422 External Reference Not Valid in Live (in Sandbox, the response is not guaranteed to be identical — to be confirmed with support; in both cases the payment is not created). This detection is applied at the application level and is not guaranteed under concurrent calls; the API does not expose any idempotency key. Generate a unique transaction_id for each attempt. Details: Errors.
Why does my Live payment return Incorrect MSISDN?
This message only concerns the format of the msisdn for the method used: it must include the expected country code and match the country and a supported operator. If the format is correct, the error comes from somewhere else — check the Ipay-Payment-Type header and the account permissions, which produce different responses. Details: Errors.