Get started

Your Pay-In credentials are created by you, in the Developer Portal of your Cashela Business dashboard. There is one portal for both environments, Sandbox and Production, and each environment has its own API keys.

Requirements

• A verified Cashela Business account (business verification approved). Sign up at cashela.com/business-home.
• A server with HTTPS that can store secrets and receive notifications.

The Developer Portal

In your Cashela Business dashboard, open Developer Portal from the menu. You see one card per environment, Sandbox and Production. Each card shows its status and its API keys. The Sandbox card also shows the sandbox Base URL with a Copy button.

Status	What it means
Provisioning	Your sandbox is being created. This usually takes less than a minute.
Provisioning failed	Setup did not finish. Click Retry provisioning; if it keeps failing, contact support.
Active	The environment is ready to use.
Under review	(Production) Your go-live request is being reviewed.
Rejected	(Production) Your go-live request was rejected. The reason is shown and you can request again.
Suspended	The environment was suspended by Cashela. Contact support.
Not enabled	(Production) Production is not enabled for your account yet. See Go live.

Your sandbox is created automatically

The first time you open the Developer Portal, your sandbox is created for you. There is nothing to request and nothing to wait for beyond the provisioning step.

• Sandbox Base URL: https://sandbox-api.cashela.com. The portal shows it with the API prefix (https://sandbox-api.cashela.com/api/v1); the endpoint paths in this guide already include /api/v1, so do not add it twice.
• Sandbox moves no real money. See Testing in sandbox.

Caution

Sandbox credentials do not work in production, and production credentials do not work in sandbox. A request with the other environment’s credentials is refused with 401.

Create an API key

The steps are the same in sandbox and, once it is enabled, in production.

1. In the environment card, go to API keys and click Create key.

2. Enter a Key name that tells you where the key is used (for example, Backend integration). Add the public IPv4 addresses allowed to use the key under IP whitelist. In production this field is required (at least one address); in sandbox it is optional (see IP whitelist below).

3. Click Create key. The portal shows your API key and your API secret.

   The secret is shown only once. Copy it now into your secret manager: you will not be able to see it again. Tick I have stored the secret in a safe place to close the dialog.

4. The key appears in the table with its Name, Key (the first characters of the key, for recognition), Status (Active or Disabled), Last used, Created and Actions.

Your API key is the username and your API secret is the password of every request. See Authentication.

Manage your keys

Each key has these actions:

Action	What it does
Disable / Enable	A Disabled key is refused with 401 Unauthorized. on every request until you enable it again. Check the status first if your requests suddenly answer 401.
IPs	Edits the key’s IP whitelist.
Rotate	Issues a new key and secret. The current key keeps working for a grace period of 7 days, so you can deploy the new secret without downtime. The portal shows the date the old key stops working.
Revoke	Revokes the key permanently. You must type the key name to confirm. Every integration still using it stops working immediately. This cannot be undone.

IP whitelist

• The list holds the public IPv4 addresses of YOUR servers, the ones that call the API with your key (create deposits, query them, Pay-Out…). It is not a list of your customers’ addresses: the checkout page your customer opens in their browser, and the return to your site, work from any IP address and are never restricted by this list.
• Production keys require at least one IP address (or CIDR range): the portal does not create or save a production key with an empty list, and it rejects entries that would allow any address (such as 0.0.0.0/0). Keys created before this rule keep working unchanged, but we recommend adding your IPs.
• In sandbox, an empty list means any IP address can use the key.
• With a list, a request from any other address is refused.
• If you add a private or reserved address (such as 10.x.x.x, 172.16–31.x.x, 192.168.x.x or 127.x.x.x), the portal warns you: no request from the internet can come from those addresses, so the key would reject every call until you add a public address. Use the public IP of the server that calls the API, not the address of your computer or office network. If your integration has no fixed IP, contact Cashela before requesting a production key.

Good practices

• Keep secrets on your servers only, in a secret manager or environment variables. Never in a browser, a mobile app or a code repository.
• Use one key per system, so you can rotate or revoke one without affecting the others.
• Rotate keys periodically and whenever someone with access leaves.
• In production, the IP whitelist with your servers’ public IPs is required.

Note

API credentials created outside the Developer Portal before it existed are no longer accepted. If you integrated earlier, create a new key in the Developer Portal for each environment.

Production

Production credentials are issued once your go-live request is approved. Until then, the Production card shows the path:

1. Integrate against the sandbox environment.
2. Complete the Go-live readiness checks with real sandbox activity.
3. Request go-live and wait for Cashela’s approval.

When Production is Active, create a production key exactly as above. Production Base URL: https://production-api.cashela.com. See Go live.

Next steps

• Authentication: make your first authenticated request.
• Integration flow: the end-to-end sequence.