Authentication

The Moflay API uses API keys to authenticate public API requests. Send the key as a Bearer token in the Authorization header.

Authorization: Bearer mof_test_your_api_key

API key prefixes

Prefix	Environment
`mof_test_`	Sandbox
`mof_live_`	Production

The API key determines the business, environment, and permissions for the request. Do not pass business or environment IDs in public API requests.

Create and store keys

Create keys in the API Keys dashboard. Copy the raw key when it is created and store it in your secret manager or deployment environment variables.

export MOFLAY_API_KEY="mof_test_your_api_key"

Treat API keys like passwords. Do not commit them to source code, expose them in frontend apps, or share them in support tickets.

Permissions

Each key has a permission set. Current public API permissions include:

Permission	Allows
`express.pay`	Create M-Pesa Express payment requests
`customers.read`	Read customer records
`customers.write`	Create, update, or delete customer records
`transactions.read`	Read transactions and payment status

Authentication errors

Missing API key

If you do not include the Authorization header, the API returns 401 Unauthorized.

{
  "error": {
    "status": 401,
    "code": "missing_api_key",
    "message": "Missing API key in the authorization header."
  }
}

Invalid API key

If the key is incorrect, malformed, or not found, the API returns 403 Forbidden.

{
  "error": {
    "status": 403,
    "code": "invalid_api_key",
    "message": "API key is invalid."
  }
}

Insufficient permissions

If the key does not have the permission required by an endpoint, the API returns 422 Unprocessable Entity.

{
  "error": {
    "status": 422,
    "code": "invalid_access",
    "message": "The API key does not have the necessary permissions to access this resource."
  }
}

CORE CONCEPTS

APIS

API key prefixes

Create and store keys

Permissions

Authentication errors

Missing API key

Invalid API key

Insufficient permissions

​API key prefixes

​Create and store keys

​Permissions

​Authentication errors

​Missing API key

​Invalid API key

​Insufficient permissions

​Related pages

API key prefixes

Create and store keys

Permissions

Authentication errors

Missing API key

Invalid API key

Insufficient permissions

Related pages