Transfer API
Authentication
This API uses API key authentication. The rest of this documentation uses the production base URL for endpoint references, request examples and API responses.
Authentication headers
Two headers are required on every request:
| Header | Type | Description |
|---|---|---|
x-api-key | string | Merchant API key |
x-api-secret | string | Merchant API secret |
API keys are generated from your SolFi merchant dashboard. They authenticate your requests and must be included in the HTTP headers of every call.
Example request
cURL
curl -X POST "https://api.katika-bridge.com/transactions/transfer" \
-H "x-api-key: your_api_key_here" \
-H "x-api-secret: your_api_secret_here" \
-H "Content-Type: application/json"Authentication errors
| Case | Returned code |
|---|---|
x-api-key missing from header | 404 Not Found |
x-api-key invalid / not found | 400 Bad Request |
x-api-secret missing from header | 400 Bad Request |
x-api-secret does not match | 400 Bad Request |
| Revoked / inactive key | 400 Bad Request |
| Inactive merchant | 400 Bad Request |
| Expired key | 400 Bad Request |
Error response format:
401 / 400 response
{
"error": true,
"statusCode": 400,
"message": "...",
"data": null
}Important notes
API keys must be kept server-side only. Never expose x-api-secret in a frontend application. Any request without valid authentication will be rejected.