Skip to main content

​
Authentication

All Wava API requests require authentication via headers. The type of header depends on your integration role.

​
Merchant authentication

Every request must include your store’s merchant key:
Your merchant key identifies your store and determines which payment gateways are available, what currency is used, and where payouts are sent.

​
Partner authentication

Partners operating on behalf of onboarded stores include three headers:
  • The merchant-key identifies the target store
  • The X-API-Key and X-API-Secret authenticate the partner (two-factor authentication)
The operation is associated with both the store and the partner for tracking and reporting.

​
Obtaining your credentials

​
Create a development account

1

Sign up

Go to https://app.dev.wava.co/ and use your email to create an account.
2

Create a test store

Create a test store with test data. This will be your sandbox environment.
3

Complete the compliance form

Fill the compliance form with test data — there are no required fields in development.
4

Navigate to Integrations

Upon activation, go to the Settings section, then open the Integrations tab.
5

Get your merchant key

Under API, you’ll find your merchant key for this environment. You can also configure your webhook URL here.
Your merchant key is available in the Wava Dashboard under Settings > Integrations > API. A separate key is provided for development and production environments.
Partner credentials (API Key and API Secret) are issued upon approval. Contact soporte@wava.co to apply for partner access. Both the API Key (X-API-Key) and API Secret (X-API-Secret) are required for authentication.

​
Security

Never expose your merchant key, partner API key, or partner API secret in client-side code (browser JavaScript, mobile apps). Always make API calls from your server.
Your keys should be stored as environment variables or in a secrets manager, never committed to source control. If you believe any credential has been compromised, contact soporte@wava.co immediately to rotate it.