Axis API Keys: Authenticate Agent Payment Requests

Every Axis wallet comes with an API key out of the box — the key is generated atomically as part of wallet creation, so there is no separate provisioning step. This makes it straightforward to wire up an agent: create a wallet, capture the key from the response, and inject it into your agent’s environment. The key is what allows an autonomous agent to submit payment intents on behalf of that wallet without ever touching a user login flow.

Key format

Axis API keys follow a fixed format:

ax_live_<48 hex characters>

Example: ax_live_3f9a1c0b2e7d4a8f... (62 characters total) For security, Axis stores only the first 14 characters (the ax_live_ prefix plus a short identifier) in plaintext. The remainder of the key is stored as a bcrypt hash. This means:

The key can be verified on every request without storing it in recoverable form.
The full key is shown exactly once — in the wallet creation response at data.apiKey.fullKey — and cannot be retrieved afterward.

The complete API key is returned a single time in data.apiKey.fullKey when the wallet is created. Copy it immediately and store it in a secrets manager or environment variable. If you lose it, the only recovery path is to create a new wallet — there is no key rotation or recovery endpoint.

How to use

Pass the full API key in the x-api-key request header. No Bearer prefix — just the raw key value.

const AXIS_API_KEY = process.env.AXIS_API_KEY; // e.g. "ax_live_3f9a1c0b2e7d4a8f..."

const response = await fetch("https://api.axispayments.ai/api/payment-intent", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": AXIS_API_KEY,
  },
  body: JSON.stringify({
    amount: 250000,               // amount in kobo (₦2,500.00)
    merchantName: "Dangote Cement",
    recipientAccountNo: "0098765432",
    recipientBankCode: "058",
    reason: "Invoice #DC-00412",
  }),
});

const data = await response.json();

Which endpoints require an API key

Endpoint	Auth method
`POST /api/payment-intent`	`x-api-key`
All other wallet and account endpoints	Session token (`Authorization: Bearer`)

API keys are purpose-built for agent-initiated payment flows. Dashboard and account management endpoints use session tokens — see Session Auth for those flows.

If a key is lost

There is currently no key rotation endpoint. If you lose a key — or suspect it has been compromised — you must create a new wallet. Treat your API key with the same care as a private key: store it in a secrets manager (e.g., AWS Secrets Manager, HashiCorp Vault, or a .env file that is never committed to source control), and limit access to only the services that need it.

API keys are scoped to exactly one wallet. A key issued for one wallet cannot be used to submit payment intents from a different wallet, even if both wallets belong to the same user account. If you need multiple agents operating independently, create a dedicated wallet — and capture its key — for each one.

Overview

Authentication

Core Flows

Monitoring

Axis API Keys: Authenticate Agent Payment Requests

Key format

How to use

Which endpoints require an API key

If a key is lost

​Key format

​How to use

​Which endpoints require an API key

​If a key is lost

Key format

How to use

Which endpoints require an API key

If a key is lost