Authentication

For a guided path from your first curl to the OpenAPI pages, SDKs, and webhook caveats, see API integration.

There are two types of API keys corresponding to lomi.'s two environments: Test and Live.

API keys

All API requests must be made over HTTPS. Requests made over plain HTTP will fail. API requests without authentication will also fail.

You must include an API key in the `X-API-Key` header for every request.

GET /accounts/balance HTTP/1.1
Host: api.lomi.africa
X-API-Key: your_api_key

HTTP header names are case-insensitive; clients may send `X-API-Key` or `X-API-KEY`.

Replace your_api_key with your specific secret API key.

Network account targeting

Approved lomi. Network Operators can target a connected Member Account by adding the optional `Lomi-Account` header.

POST /checkout-sessions HTTP/1.1
Host: api.lomi.africa
X-API-Key: your_operator_api_key
Lomi-Account: acct_1234567890

When `Lomi-Account` is absent, requests behave like normal merchant API calls. When it is present, the API key organization is the Operator and the `acct_...` account is the target Member Account. See lomi. Network for supported endpoints and required capabilities.

Test vs. Live environments

lomi. provides two distinct environments to separate development and testing from production operations.

Test environment

Use the test environment to develop and test your integration without processing real transactions or affecting live data. It mirrors the functionality of the live environment.

• API Keys: Test API keys start with `lomi_sk_test_`.
• Base URL: `https://sandbox.api.lomi.africa`
• Rate Limits: 120 requests per minute / 20,000 requests per day.
• Data: Uses simulated data. Responses may include environment flags like `"environment": "test"`.

To simulate card and mobile money payments (test card numbers, Wave, MTN MoMo), see Sandbox payments.

Live environment

Use the live environment for production operations involving real transactions.

• API Keys: Live API keys start with `lomi_sk_live_`.
• Base URL: `https://api.lomi.africa`
• Rate Limits: 60 requests per minute / 10,000 requests per day.
• Data: Processes real data. Responses may include environment flags like `"environment": "live"`.

To switch between environments, simply use the appropriate API key and base URL.

Obtaining API keys

You can obtain your API keys after signing up and completing verification:

1. Log in to the dashboard.
2. Navigate to the Developers or API Settings section.
3. Generate separate API keys for the Test and Live environments.

Key management and security

Treat your API keys as sensitive credentials. You can manage them (generate, revoke, view usage) in the merchant dashboard.

Best practices:

• Keep keys confidential: Do not share your secret keys. Store them securely (e.g., environment variables, secrets management service).
• Never expose keys client-side: Do not embed API keys in frontend code.
• Avoid version control: Do not commit keys to your codebase.
• Use test keys for development: Only use live keys for production applications.
• Rotate keys: Consider rotating keys periodically or if you suspect a compromise.
• Limit access: Restrict access to API keys within your organization.