Skip to main content
Every request to the cNGN API must be authenticated with an API key sent as a Bearer token:

​
Environments

The API key prefix determines the environment. Both environments use the same base URL (https://api.cngn.co/v1/api): Each environment has its own independent set of credentials:
  • API key: identifies your business
  • Encryption key: AES key used to encrypt request bodies
  • Ed25519 SSH public key: used by the API to encrypt response payloads to you
A key from one environment never works against the other’s data. Using a token without a recognised prefix fails with Invalid token prefix.

​
IP whitelisting

After the API key check, the request’s source IP is validated against your whitelist. Requests from non-whitelisted addresses are rejected:
Manage the whitelist from your merchant dashboard. Remember to add every egress IP your infrastructure uses (load balancers, NAT gateways, serverless egress ranges).

​
Authentication errors

​
Key rotation and safety

  • Store keys in a secrets manager, never in code or client-side bundles.
  • Rotate keys immediately if you suspect exposure: generate a new key in the dashboard and update your deployment.
  • Use test keys everywhere except production infrastructure.