generated: '2026-07-17' method: modeled-from-docs source: https://developer-docs.paga.com/docs/introduction summary: types: - http - apiKey schemes: - name: basic_auth type: http scheme: basic description: >- Collect API and Direct Debit API authenticate with HTTP Basic using base64(publicKey:secretKey) - the account principal (public key) and credential (secret key). appliesTo: - Paga Collect API - Paga Direct Debit API sources: - https://developer-docs.paga.com/docs/paga-collect-api - name: principal type: apiKey in: header headerName: principal description: Business API public key (principal / merchant public ID), sent as a header. appliesTo: - Paga Business API sources: - https://developer-docs.paga.com/docs/introduction - name: credentials type: apiKey in: header headerName: credentials description: Business API secret key (credential / password), sent as a header. appliesTo: - Paga Business API sources: - https://developer-docs.paga.com/docs/introduction - name: hash type: apiKey in: header headerName: hash description: >- Every operation additionally requires a SHA-512 hash header computed over an operation-specific ordered concatenation of request parameters followed by the account hash key (HMAC key from the Business dashboard), joined with no separators. Example order for Deposit To Bank: referenceNumber + amount + destinationBankUUID + destinationBankAccountNumber + hashKey. The hash key itself is never transmitted. appliesTo: - Paga Business API - Paga Collect API - Paga Direct Debit API sources: - https://developer-docs.paga.com/docs/handling-hash notes: >- Credentials (public key, secret key, hash key) are issued from the Paga Business Account dashboard under Developer Tools > API keys, with separate test and live sets. The Business API additionally requires the caller's IP address to be whitelisted before access is granted. Paga Connect is a separate OAuth 2.0 hosted-checkout flow and is not covered by the hash scheme above. regions: - Nigeria currency: NGN