Authentication

Overview

Monei supports api key authentication method

API Key Authentication

The simplest and most common authentication method for server-side applications.

Getting Your API Key

Navigate to Dashboard

Go to monei.cc

Create New Key

Click Create New Key and provide:

Key name (for identification)
Environment (sandbox or production)
Permissions (optional scoping)

Save Securely

Copy your API key immediately - it won’t be shown again

Store API keys in environment variables, never commit them to source control.

Using API Keys

Include your API key in the x-api-key header:

import MoneiSDK from 'monei-sdk';

const monei = new MoneiSDK({
  apiKey: process.env.MONEI_API_KEY,
});

// All requests will include the API key automatically
const account = await monei.user.getWallet();

from monei import MoneiClient
import os

monei = MoneiClient(
    api_key=os.getenv('MONEI_API_KEY')
)

# All requests will include the API key
account = monei.user.get_wallet()

curl https://api.monei.cc/api/v1/user/me \
  -H "x-api-key: YOUR_API_KEY"

API Key Permissions

Control what your API keys can access:

Permission	Description	Use Case
Read Only	View account and transaction data	Analytics dashboards
Transactions	Execute transactions	Payment processing
Account Management	Modify account settings	Admin operations
Full Access	All operations	Backend services

Always use the minimum required permissions for each API key to enhance security.

Security Best Practices

API Key Management

Do:

Store keys in environment variables
Use different keys for development and production
Rotate keys regularly (every 90 days)
Use scoped permissions
Monitor key usage

Don’t:

Commit keys to version control
Share keys via email or chat
Use production keys in development
Hardcode keys in client-side code

Token Security

Storage:

Server-side: Environment variables, secure vaults
Client-side: httpOnly cookies, secure storage APIs
Never in localStorage or sessionStorage

Transmission:

Always use HTTPS
Never include tokens in URLs
Use secure headers only

Lifecycle:

Implement token refresh before expiration
Clear tokens on logout
Revoke compromised tokens immediately

Network Security

Transport:

Always use TLS 1.2 or higher
Verify SSL certificates
Use certificate pinning in mobile apps

Rate Limiting:

Implement client-side rate limiting
Handle 429 responses gracefully
Use exponential backoff

IP Whitelisting:

Restrict API access to known IPs (enterprise)
Use VPN for sensitive operations

Monitoring & Auditing

Track:

All authentication attempts
Failed login attempts
API key usage patterns
Unusual activity

Alerts:

Multiple failed logins
API calls from new locations
Suspicious transaction patterns
Key usage spikes

Logging:

Log all authentication events
Monitor access patterns
Review logs regularly
Set up automated alerts

Authentication Errors

Common authentication errors and how to resolve them:

401 Unauthorized
403 Forbidden
429 Rate Limited

Cause: Invalid or missing credentialsSolutions:

Verify API key is correct
Check token hasn’t expired
Ensure proper header format
Confirm environment (sandbox vs production)

{
  "statusCode": 401,
  "message": "Invalid API key",
  "error": "Unauthorized"
}

Cause: Valid credentials but insufficient permissionsSolutions:

Check API key permissions
Verify account tier limits
Ensure operation is allowed
Contact support for permission changes

{
  "statusCode": 403,
  "message": "Insufficient permissions",
  "error": "Forbidden"
}

Cause: Too many requests in a short periodSolutions:

Implement exponential backoff
Check rate limit headers
Upgrade plan if needed
Cache responses when possible

{
  "statusCode": 429,
  "message": "Rate limit exceeded",
  "retryAfter": 60
}

Environment Variables

Recommended environment variable structure:

# Monei API Configuration
MONEI_API_KEY=your_api_key_here

# Copy this file to .env and fill in your values

# Required
MONEI_API_KEY=
MONEI_ENVIRONMENT=sandbox

Never commit your .env file to version control. Add it to .gitignore.

Testing Authentication

Test your authentication setup:

import MoneiSDK from 'monei-sdk';

async function testAuthentication() {
  const monei = new MoneiSDK({
    apiKey: process.env.MONEI_API_KEY,
  });

  try {
    // Test API key authentication
    const account = await monei.user.getCurrentUser();
    console.log('✓ Authentication successful');
    console.log('Account ID:', account.id);
    console.log('KYC Tier:', account.kycInfo.currentTier);
    
    return true;
  } catch (error) {
    console.error('✗ Authentication failed:', error.message);
    return false;
  }
}

testAuthentication();

from monei import MoneiClient
import os

def test_authentication():
    monei = MoneiClient(
        api_key=os.getenv('MONEI_API_KEY')
    )
    
    try:
        # Test API key authentication
        account = monei.user.get_current_user()
        print('✓ Authentication successful')
        print(f'Account ID: {account.id}')
        print(f'KYC Tier: {account.kyc_info.current_tier}')
        return True
    except Exception as error:
        print(f'✗ Authentication failed: {str(error)}')
        return False

if __name__ == '__main__':
    test_authentication()

#!/bin/bash

# Test authentication
RESPONSE=$(curl -s -w "\n%{http_code}" \
  https://api.monei.cc/api/v1/user/me \
  -H "x-api-key: $MONEI_API_KEY")

HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
BODY=$(echo "$RESPONSE" | head -n-1)

if [ "$HTTP_CODE" = "200" ]; then
  echo "✓ Authentication successful"
  echo "$BODY" | jq .
else
  echo "✗ Authentication failed (HTTP $HTTP_CODE)"
  echo "$BODY" | jq .
fi

Next Steps

Core Concepts

Learn about wallets, transactions, and networks

Security Guidelines

Comprehensive security best practices

API Reference

Explore all available endpoints

Webhooks

Set up secure webhook integrations

Introduction

Core Concepts

Account Management

Naira Wallet

EVM Blockchain

Solana

Offramp (Crypto to Fiat)

Bill Payments

Transactions

Security

Testing

Overview

API Key Authentication

Getting Your API Key

Using API Keys

API Key Permissions

Security Best Practices

Authentication Errors

Environment Variables

Testing Authentication

Next Steps

Core Concepts

Security Guidelines

API Reference

Webhooks

​Overview

​API Key Authentication

​Getting Your API Key

​Using API Keys

​API Key Permissions

​Security Best Practices

​Authentication Errors

​Environment Variables

​Testing Authentication

​Next Steps

Core Concepts

Security Guidelines

API Reference

Webhooks

Overview

API Key Authentication

Getting Your API Key

Using API Keys

API Key Permissions

Security Best Practices

Authentication Errors

Environment Variables

Testing Authentication

Next Steps