Every request to the Swipe Aras API must be authenticated using an API key. API keys are created and managed from the Developer → API Keys section of your dashboard.
Authentication Method
Include your API key in the X-API-Key request header:
curl "https://api.araspayment.com/api/v1/transactions" \
-H "X-API-Key: DBAB6DB0.709B38A4AFC9BEA637624BFA5477E70980C75FDBC7" \
-H "Content-Type: application/json"API Key Format
API keys consist of two parts separated by a dot:
Part | Length | Description |
|---|---|---|
Prefix | 8 characters | Visible in your dashboard for identification |
Secret | Variable | The secret portion — shown only once at creation |
Example: DBAB6DB0.709B38A4AFC9BEA637624BFA5477E70980C75FDBC7
Save your full API key when you create it. Only the 8-character prefix is displayed in the dashboard after creation. The secret portion cannot be retrieved — if lost, you must regenerate the key.
Creating an API Key
Go to Developer → API Keys in your dashboard
Click Create API Key
Give it a descriptive name (e.g., "Production Integration", "Staging")
Select the permissions this key should have
Copy and store the full key securely
Why am I getting a 401?
A 401 response from the Swipe Aras API has three possible causes:
Missing X-API-Key header — the response will be "API key required. Include X-API-Key header."
Invalid, expired, or revoked key — the response will be "Invalid or expired API key."
Your merchant account has been suspended or deactivated — the response will be "Invalid or expired API key" (same message as cause 2). Contact your account manager for suspension reasons.
When 401 isn't really about your key
Your API key is active immediately upon creation. There is no activation period — keys do not require additional sign-off before they can authenticate.
HTTP 400 "Store missing adyenStoreId or balanceAccountId" — your store has not finished provisioning in Adyen. The error code is STORE_CONFIG. This resolves automatically as onboarding completes.
HTTP 200 with resultCode: 'Refused' in response body — your API call succeeded but the payment was refused by Adyen. Always inspect resultCode rather than relying on HTTP status alone.
Security Best Practices
Never include API keys in client-side code or public repositories
Use environment variables to store keys in your applications
Create separate keys for development, staging, and production
Regenerate keys immediately if you suspect compromise
Scope each key to only the permissions it needs