Core concepts

Authentication

Every request carries your API key in a header.

Required headers

X-Api-Key: <your-api-key>
Content-Type: application/json

Keep your API key secret. It is issued once and cannot be retrieved again.
Requests with a missing or invalid key return 401 Unauthorized.

Server side only. Call the API from your backend. Never ship the key in a mobile app, a browser bundle, or anything else a customer can read.

If a key is exposed#

Treat it as compromised and contact us to have it replaced. See Key lifecycle for how replacement works.

Maly Payments API v1 · Documentation 1.1 · July 2026
Maly Tech Ltd. This guide is provided for information. Where it differs from your signed agreement, the agreement applies.