Authentication

LaikiPayenforces a single, unified, zero-trust authentication architecture: Token-Based Bearer Authentication. All API operations (virtual cards, balance queries, funding, spend limits, and transactions) authenticate using short-lived 15-minute Bearer Access Tokens issued by the LaikiPaytoken service.

Authentication Flow Overview

1. Authenticate & Obtain Token
   POST /v1/merchant/auth/token
   Body: { merchantId, secretKey }
             │
             ▼
   Returns: { accessToken, expiresIn: 900, tokenType: "Bearer" }

2. Execute API Calls
   GET /v1/merchant/cards/config
   POST /v1/merchant/cards
   Header: Authorization: Bearer <accessToken>

Step 1: Obtain a 15-Minute Access Token

To interact with the API, exchange your Merchant ID and Secret Key for a short-lived access token:

Request

POST https://api.laikipay.com/v1/merchant/auth/token
Content-Type: application/json

Request Body

{
  "merchantId": "mid_lk_9a4f21e0b8c4d29a",
  "secretKey": "sk_test_9401ab38f8219cb7d4e320f0a82"
}

curl -X POST "https://api.laikipay.com/v1/merchant/auth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "merchantId": "mid_lk_9a4f21e0b8c4d29a",
    "secretKey": "sk_test_9401ab38f8219cb7d4e320f0a82"
  }'

const tokenResponse = await fetch('https://api.laikipay.com/v1/merchant/auth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    merchantId: 'mid_lk_9a4f21e0b8c4d29a',
    secretKey: 'sk_test_9401ab38f8219cb7d4e320f0a82',
  }),
});

const { data } = await tokenResponse.json();
const accessToken = data.accessToken;

import requests

res = requests.post(
    "https://api.laikipay.com/v1/merchant/auth/token",
    json={
        "merchantId": "mid_lk_9a4f21e0b8c4d29a",
        "secretKey": "sk_test_9401ab38f8219cb7d4e320f0a82"
    }
)
access_token = res.json()["data"]["accessToken"]

Response (`200 OK`)

{
  "status": "success",
  "data": {
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjbXJjXzAxIiwibWVyY2hhbnRJZCI6Im1pZF9sayIsImVudmlyb25tZW50IjoiVEVTVCIsInR5cGUiOiJtZXJjaGFudF9hcGlfdG9rZW4ifQ...",
    "tokenType": "Bearer",
    "expiresIn": 900,
    "environment": "TEST",
    "merchantId": "mid_lk_9a4f21e0b8c4d29a"
  },
  "timestamp": "2026-10-12T07:10:00.000Z",
  "path": "/v1/merchant/auth/token"
}

Step 2: Authorize Subsequent Requests

Provide the generated accessToken in the Authorization header of every API request:

Authorization: Bearer <accessToken>

cURL Example

curl -X GET "https://api.laikipay.com/v1/merchant/cards/config" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

Token Lifecycle & Auto-Refresh

Validity Period: Access tokens are valid for 15 minutes (900 seconds) from creation.
Auto-Refresh Best Practice: Cache the accessToken in your application memory or Redis cache with an expiration of 14 minutes. When expired, invoke POST /v1/merchant/auth/token again to fetch a fresh token.
Stateless & Scalable: Ephemeral tokens eliminate the security risk of keeping long-lived credentials in distributed containers or serverless instances.

Getting Started

Virtual Cards API

Webhooks

Authentication

Authentication

Authentication Flow Overview

Step 1: Obtain a 15-Minute Access Token

Request

Response (`200 OK`)

Step 2: Authorize Subsequent Requests

Token Lifecycle & Auto-Refresh

​Authentication

​Authentication Flow Overview

​Step 1: Obtain a 15-Minute Access Token

​Request

​Response (200 OK)

​Step 2: Authorize Subsequent Requests

​Token Lifecycle & Auto-Refresh

Authentication

Authentication Flow Overview

Step 1: Obtain a 15-Minute Access Token

Request

Response (`200 OK`)

Step 2: Authorize Subsequent Requests

Token Lifecycle & Auto-Refresh