Malga’s API services are protected through access keys. You can manage your access keys through your dashboard.

It is important to store your keys privately and safely since they have modification privileges in your account. Do not share your keys, do not leave them fixed in your code, and do not store them on your version control server. We recommend using secret environment variables to make the key available to your application.

Authentication for all API calls is done through HTTP headers, requiring you to enter your Malga client identifier and secret access key.

Unique identifier of your account on Malga. It must be sent in the header as a mandatory field in all requests made to the API.

Your API access key. It works in conjunction with the client-id and must be sent in the header of all requests made to the API, mandatory.

  curl --location --request GET 'https://api.malga.io/v1/' \
    --header 'X-Client-Id: <YOUR_CLIENT_ID>' \
    --header 'X-Api-Key: <YOUR_SECRET_KEY>'

You can create temporary public keys to access the API with limited scope and expiration time.

We recommend using this type of key when you need to expose the key in a client-side application. In this case, you should make a call to the /auth service from your secret key, requesting the creation of a public key with limited scope.

The created public key can be used normally as if it were your account's secret key, but with the scope restriction and being invalidated upon expiration.

Parameters’ details of the public key’s request:

Public key creation response

Parameters’ details of the card token's request:

Attributues of a card object

Through the customer’s API you can create, edit, list, and delete shopper’s data for use in card tokenization services, PIX charges, Invoices (payment slips), use in anti-fraud and recurrence engine analysis.

In order to maintain data integrity, email and document (Personal registration number/National registry of legal entities) information are unique to customers on your Malga account, and no two buyers can be the same.

To implement a charge, you must create a charge object. You can retrieve details of individual transactions, or list all the charges made at a given merchant. Charges are identified by a 'unique' id.

Basic data of an charge object