Authentication

All API requests must be made over HTTPS to: https://kda-turbo-web.vercel.app

API Keys

Every request to the KDA API must include an Authorization header with a valid API key.

You can generate API keys from your Dashboard → Settings → Dev Console page. Each developer account receives two keys:

Test Key

Prefix: kds_test_

Routes to the sandbox — no real money is spent. Use during development.

Live Key

Prefix: kds_live_

Routes to production providers. Real transactions are processed.

Using Your Key

Pass your key as a Bearer token in the Authorization header:

curl -X GET https://kda-turbo-web.vercel.app/api/profile/balance \
  -H "Authorization: Bearer kds_test_YOUR_API_KEY"

const response = await fetch("https://kda-turbo-web.vercel.app/api/profile/balance", {
  headers: {
    "Authorization": "Bearer kds_test_YOUR_API_KEY",
    "Content-Type": "application/json"
  }
});

const data = await response.json();
console.log(data.balance);

import requests

headers = {
    "Authorization": "Bearer kds_test_YOUR_API_KEY",
    "Content-Type": "application/json"
}

response = requests.get(
    "https://kda-turbo-web.vercel.app/api/profile/balance",
    headers=headers
)
print(response.json())

<?php

$ch = curl_init("https://kda-turbo-web.vercel.app/api/profile/balance");
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer kds_test_YOUR_API_KEY",
        "Content-Type: application/json",
    ],
    CURLOPT_RETURNTRANSFER => true,
]);

$response = curl_exec($ch);
curl_close($ch);

$data = json_decode($response, true);
print_r($data);

Key Behavior

Test keys automatically route all purchases through the sandbox simulator → no real charges occur.
Live keys route to production VTU providers and debit your wallet.

Key Status

Invalid or missing keys return 401 Unauthorized.
Disabled keys return 401 with "keyStatus": "DISABLED".

When an API key is supplied but cannot be fully validated, the 401/403 error object includes a keyStatus field describing the state of the key that was evaluated. Requests missing the Authorization header entirely return 401 without it.

keyStatus	Meaning
`INVALID`	The key does not exist, is malformed, or failed verification.
`NOT_FOUND`	The key passed verification but no matching record exists.
`DISABLED`	The key exists but has been disabled. Re-enable it in the Developer Console.
`FORBIDDEN`	The key is valid but lacks the required scope or privileges for this endpoint.

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or expired API Key",
    "keyStatus": "INVALID"
  }
}

Security Best Practices

Never expose your Live key in client-side code (frontend, mobile apps).
Store keys securely in environment variables or a secrets manager.
Rotate keys periodically from the developer dashboard.
Use Test keys exclusively during development and CI/CD pipelines.