pasbydocs
Reference

Migration v1 → v2

Move from authorize + token to API key + secret on the public API.

Why migrate

v1v2
Authorize → token lifecycleAPI key + secret on each call
Token expiry managementNo session token required
No SSE or wildcard signingSSE + wildcard signing
Polling as primary statusPing + SSE recommended

Auth migration

v1v2 replacement
GET /api/v1/flow/authorizeNot needed — use x-access-secret directly
x-access-token headerx-access-secret header
Token refresh logicRemove — rotate secret via Console

Endpoint availability

Endpointv1v2
Identification same-deviceYesYes
Identification different-deviceYesYes
Identification wildcardYesYes
Signing same-deviceYesYes
Signing different-deviceYesYes
Signing wildcardNoYes
Flow authorizeYesNo
Flow pingYesYes
Flow SSENoYes
Flow pollingYesYes*
Flow cancelYesYes
Document signingYesYes
Document reviewYesYes
Document refreshYesYes

* v2 polling still requires x-access-token. Prefer ping or SSE.

Header changes (summary)

Route familyv1v2
Identification same-devicekey + secretkey + secret
Identification different-devicekey + tokenkey + secret
Identification wildcardkey (+ token recommended)key only
Signing same-devicekey + secret + tokenkey + secret
Signing different-devicekey + tokenkey + secret
Document *key + tokenkey + secret

Checklist

  • Replace authorize + token with key + secret
  • Update paths /api/v1//api/v2/
  • Replace long-polling with ping loop or SSE
  • Add wildcard signing if needed (v2 only)
  • Verify Console scopes cover v2 endpoints
  • Test with bk-test_ on s.pasby.africa before bk-live_ on l.pasby.africa
  • Update webhook handlers if paths changed (delivery contract: Webhooks)

Legacy v1 examples remain valid for existing consumers — do not mix v1 tokens into v2 quickstarts.

On this page