> ## Documentation Index
> Fetch the complete documentation index at: https://ifemafia.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Axis API Keys: Authenticate Agent Payment Requests

> Each Axis wallet ships with a unique API key prefixed ax_live_. Pass it in the x-api-key header to authenticate payment intent requests.

Every Axis wallet comes with an API key out of the box — the key is generated atomically as part of wallet creation, so there is no separate provisioning step. This makes it straightforward to wire up an agent: create a wallet, capture the key from the response, and inject it into your agent's environment. The key is what allows an autonomous agent to submit payment intents on behalf of that wallet without ever touching a user login flow.

***

## Key format

Axis API keys follow a fixed format:

```
ax_live_<48 hex characters>
```

**Example:** `ax_live_3f9a1c0b2e7d4a8f...` (62 characters total)

For security, Axis stores only the **first 14 characters** (the `ax_live_` prefix plus a short identifier) in plaintext. The remainder of the key is stored as a bcrypt hash. This means:

* The key can be verified on every request without storing it in recoverable form.
* **The full key is shown exactly once** — in the wallet creation response at `data.apiKey.fullKey` — and cannot be retrieved afterward.

<Warning>
  The complete API key is returned a single time in `data.apiKey.fullKey` when the wallet is created. **Copy it immediately and store it in a secrets manager or environment variable.** If you lose it, the only recovery path is to create a new wallet — there is no key rotation or recovery endpoint.
</Warning>

***

## How to use

Pass the full API key in the `x-api-key` request header. No `Bearer` prefix — just the raw key value.

```typescript theme={null}
const AXIS_API_KEY = process.env.AXIS_API_KEY; // e.g. "ax_live_3f9a1c0b2e7d4a8f..."

const response = await fetch("https://api.axispayments.ai/api/payment-intent", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": AXIS_API_KEY,
  },
  body: JSON.stringify({
    amount: 250000,               // amount in kobo (₦2,500.00)
    merchantName: "Dangote Cement",
    recipientAccountNo: "0098765432",
    recipientBankCode: "058",
    reason: "Invoice #DC-00412",
  }),
});

const data = await response.json();
```

***

## Which endpoints require an API key

| Endpoint                               | Auth method                             |
| -------------------------------------- | --------------------------------------- |
| `POST /api/payment-intent`             | `x-api-key`                             |
| All other wallet and account endpoints | Session token (`Authorization: Bearer`) |

API keys are purpose-built for agent-initiated payment flows. Dashboard and account management endpoints use session tokens — see [Session Auth](/guides/session-auth) for those flows.

***

## If a key is lost

There is currently no key rotation endpoint. If you lose a key — or suspect it has been compromised — **you must create a new wallet**. Treat your API key with the same care as a private key: store it in a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault, or a `.env` file that is never committed to source control), and limit access to only the services that need it.

<Note>
  API keys are scoped to exactly one wallet. A key issued for one wallet cannot be used to submit payment intents from a different wallet, even if both wallets belong to the same user account. If you need multiple agents operating independently, create a dedicated wallet — and capture its key — for each one.
</Note>