Skip to navigation
Guides

Authentication

Every request needs your Halo partner API key. Send it as a bearer token:

GET /api/test HTTP/1.1
Host: api.haloinvest.ng
Authorization: Bearer YOUR_API_KEY

Call GET /api/test to check your key. It answers with your business ID and name.

When a key is refused

Halo answers 401 when:

  • the Authorization header is missing,
  • the key is not recognised, or
  • your business has been switched off by Halo.

The body is the same in each case. It does not use the normal response envelope:

{
  "error": {
    "message": "Unauthorized"
  }
}

Keeping your key safe

  • Call the API only from your servers. Never put the key in a mobile app or a web page.
  • Each key belongs to one business. Every account, transfer and reference you see through the API is limited to that business.
  • If you think a key has leaked, contact Halo to replace it.