Authentication

Every NeraSika API request needs an access token, except the request that creates the token.

Your credentials

When your merchant account is created, Nerasol emails you:

a merchant ID, which identifies your account, and
a merchant secret, which proves the request comes from you.

Generate a token

POST/api/v1/transactions/auth/token

Where	Field	Value
Header	`x-merchant-secret`	Your merchant secret
Body	`merchantId`	Your merchant ID

curl -X POST https://preprod.api.nerasika.com/api/v1/transactions/auth/token \
  -H "Content-Type: application/json" \
  -H "x-merchant-secret: $NERASIKA_SECRET" \
  -d '{ "merchantId": "'"$NERASIKA_MERCHANT_ID"'" }'

Response:

{
  "success": true,
  "message": "Transaction token generated successfully",
  "data": {
    "token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

Use the token

Send it in the Authorization header of every other request:

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Token lifetime and caching

A token is valid for 24 hours.
Cache it and reuse it for all requests until it is close to expiry. Don’t request a new token for each payment.
The token endpoint is rate limited to 50 requests per 20 minutes per IP address. Requesting a token per payment will hit this limit.
When a request returns 401, get a new token and retry once.

Errors

Status	Message	What to do
`400`	`Invalid credentials` / `Invalid merchant credentials`	Check your merchant ID and secret.
`400`	`Unknown field values provided...`	Send only `merchantId` in the body.
`401`	`Not authorized`	The token is missing, malformed, expired or revoked. Get a new one.
`403`	`Invalid token type provided`	You sent a dashboard login token. Use a token from this endpoint.
`429`	`Too many requests, please try again later`	Wait, and cache tokens instead of requesting new ones.
`500`	`Merchant secret must be provided`	Add the `x-merchant-secret` header. (This currently returns `500` rather than `400`.)