Authentication & API keys

Your API credentials

API keys identify your Strongmb account and authorize your server to access account details, products and purchases. Credentials are created when you create a Strongmb account. Open the Developer section to view the live and test credentials.

Get your API key

1. Sign in to Strongmb.

   Open the dashboard login page. If you do not have an account, follow the account setup guide.

2. Open your dashboard.

   Complete any account prompts shown after sign-in.

3. Open the menu at the top left.

   Select Developers to open your developer settings.

4. Choose Live or Test keys.

   Use the secret key for the environment you are integrating with. Public keys and webhook tokens may be visible, but they are not active API authentication methods in this version.

5. Copy the secret key to your server environment.

   Store it as STRONGMB_API_KEY. Do not paste it into frontend JavaScript or a mobile app bundle.

Authorize server requests

Send your secret key in the Authorization header on every request. The header value is the word Bearer, a space, then the key.

Authorization: Bearer YOUR_SECRET_KEY

Use Content-Type: application/json when sending a JSON request body. Do not put the key in a URL query parameter, and do not add a colon after Bearer.

Example: authenticate with Node.js

// Server-side Node.js 22+.
async function readAccount() {
  const secretKey = process.env.STRONGMB_API_KEY;
  if (!secretKey) throw new Error("Set STRONGMB_API_KEY on your server");

  const response = await fetch("https://api.strongmb.ng/v1/user", {
    headers: {
      Authorization: `Bearer ${secretKey}`,
      Accept: "application/json"
    },
    signal: AbortSignal.timeout(30000)
  });
  const result = await response.json();
  console.log(response.status, result);
}
readAccount().catch(console.error);

This example targets the live API. For testing, use the test secret key with the sandbox base URL described in Environments & base URLs.

Authenticate through a backend SDK

With a Strongmb backend SDK, provide the secret key when initializing the library. The client adds the authentication header for you. You do not need to construct the header manually for every SDK call.

const strongmb = new Strongmb(process.env.STRONGMB_API_KEY);

Follow the installation and imports in the Node.js SDK guide, PHP guide or Python guide. Constructor options and naming vary by language.

Protect and rotate your keys

• Keep keys in an environment variable or secret manager on your server.
• Keep test and live configuration separate.
• Redact Authorization headers from logs, screenshots and support messages.
• Never commit a key to Git, including a private repository.

Resolve an authentication error

Do not repeatedly retry with invalid credentials. Correct the configuration first. Read error handling for request diagnostics.