Authorization

1. Key Types

Your account has two API keys that together make up your credentials:

Key Type	Prefix	Description	Security
Public Key	`pb_live_`	Identifies your account for authorization.	Publicly viewable in dashboard
Secret Key	`sk_live_`	Used to sign your requests. Never share this key.	Keep secret and secure

2. Authentication Mechanism

OriginBills uses standard HTTP Basic Authentication. You construct the header as follows:

Concatenate keys: Combine your Public Key and Secret Key, separated by a colon (:).
pb_live_example123:sk_live_example987
Encode to Base64: Encode the concatenated string into Base64 format.
cGJfbGl2ZV9leGFtcGxlMTIzOnNrX2xpdmVfZXhhbXBsZTk4Nw==
Set the Header: Add the string to your request’s Authorization header, prefixed with Basic .
Authorization: Basic cGJfbGl2ZV9leGFtcGxlMTIzOnNrX2xpdmVfZXhhbXBsZTk4Nw==

3. Code Examples

Below are examples of how to configure the Authorization header in various languages.

cURL

curl -X GET "https://api.originbills.in/v1/balance/main-wallet" \
     -H "Authorization: Basic cGJfbGl2ZV9leGFtcGxlMTIzOnNrX2xpdmVfZXhhbXBsZTk4Nw=="

Node.js (Fetch API)

const publicKey = 'pb_live_example123';
const secretKey = 'sk_live_example987';
const credentials = Buffer.from(`${publicKey}:${secretKey}`).toString('base64');

fetch('https://api.originbills.in/v1/balance/main-wallet', {
  method: 'GET',
  headers: {
    'Authorization': `Basic ${credentials}`,
    'Accept': 'application/json'
  }
})
.then(res => res.json())
.then(data => console.log(data))
.catch(err => console.error(err));

Python (requests)

import requests
from requests.auth import HTTPBasicAuth

url = "https://api.originbills.in/v1/balance/main-wallet"
public_key = "pb_live_example123"
secret_key = "sk_live_example987"

response = requests.get(url, auth=HTTPBasicAuth(public_key, secret_key))
print(response.json())

4. Query Parameter Authorization (GET requests only)

For convenience in client environments or simple testing, GET endpoints support sending the Authorization credentials via the authorization query parameter:

GET https://api.originbills.in/v1/recharge/status?order_id=TXN12345&authorization=Basic%20cGJfbGl2ZV9leGFtcGxlMTIzOnNrX2xpdmVfZXhhbXBsZTk4Nw==

5. Security Best Practices

[!WARNING] Keep your credentials secure. Your API keys have full access to view wallet balances and place recharges.

Never commit secret keys to public repositories or front-end client bundles.
Rotate your API keys regularly from the OriginBills dashboard if you suspect a leak.
Use HTTPS always: Plain HTTP requests transmitting credentials will be rejected.

6. Authentication Errors

If your credentials are missing, invalid, or formatted incorrectly, the API returns 401 Unauthorized with one of the following schemas:

Missing Header or Parameter

{
  "status": false,
  "message": "Authorization header is required." // or "authorization body paramas is required." for GET
}

Invalid Credentials Format

{
  "status": false,
  "message": "Invalid Authorization header format."
}

Incorrect Keys

{
  "status": false,
  "message": "Invalid credentials."
}

Getting Started

Balance API

Recharge API

BBPS API

1. Key Types

2. Authentication Mechanism

3. Code Examples

cURL

Node.js (Fetch API)

Python (requests)

4. Query Parameter Authorization (GET requests only)

5. Security Best Practices

6. Authentication Errors

Missing Header or Parameter

Invalid Credentials Format

Incorrect Keys

​1. Key Types

​2. Authentication Mechanism

​3. Code Examples

​cURL

​Node.js (Fetch API)

​Python (requests)

​4. Query Parameter Authorization (GET requests only)

​5. Security Best Practices

​6. Authentication Errors

​Missing Header or Parameter

​Invalid Credentials Format

​Incorrect Keys

1. Key Types

2. Authentication Mechanism

3. Code Examples

cURL

Node.js (Fetch API)

Python (requests)

4. Query Parameter Authorization (GET requests only)

5. Security Best Practices

6. Authentication Errors

Missing Header or Parameter

Invalid Credentials Format

Incorrect Keys