Authentication

How to authenticate your REST API 2.0 requests
Last updated: Jun 10, 2026

REST API 2.0 supports two authentication methods. Every request must include one of the following:

Method	Header	When to Use
API Key	x-api-key: {your API key}	Recommended for most server-to-server integrations. Simple, stateless, and does not expire.
Bearer Token	Authorization: Bearer {token}	Used for token-based flows requiring temporary, scoped access or client-initiated operations.

---

Obtaining Your Credentials

API Key

API keys are managed via the Control Panel under:
Settings > REST 2.0 API Credentials

Access is available to users with Developer Only or Temp roles.
Refer to REST 2.0 API Credentials for full instructions.

---

Types of API Keys

Key Type	Purpose
Operations API Key	Used for payments, disputes, and data-related operations
Dispute API Key	Used for dispute-specific endpoints

Tip: Multiple API keys can be created per Entity ID + Site Name pair to support key rotation, environment separation, and enhanced security.

---

Using Your Credentials

Example Request

POST /payment-api/payments HTTP/1.1
Host: api.nuvei.com
Content-Type: application/json
x-api-key: {your API key}

{
    "processingEntityId": "dbdaacd8-e2b8-4e80-81e7-736a3e241fd0",
    "transactionType": "Sale",
    "amount": 60,
    "currency": "EUR"
}

---

API Key Hierarchy

• Each parent and child entity can have its own API key (if defined)
• Child entities without a key inherit the parent’s API key
• Parent entity API keys are not visible from child entity views

---

Security Best Practices

⚠️ Warning: Never expose credentials in client-side code (e.g., browser JavaScript or mobile apps)

• Store credentials server-side only
• Separate credentials per environment (sandbox / production)
• Rotate API keys regularly (multiple active keys are supported)
• Restrict access to the API Credentials page.

---