The Initialise section of the Paystack API website has several issues that make it harder for developers to understand and implement correctly.
These problems are identified here, with a clearer fix rewritten, and an explanation for why the improved version is better.
The documentation says:
"Initialise the transaction from your backend"
It doesn't clearly answer:
This can be difficult for a beginner to grasp, leaving them without a clear understanding of the step.
The code is introduced too quickly, going straight to:
curl https://api.paystack.co/transaction/initialize Without clearly explaining:
This can quickly increase cognitive load.
It says:
"access_code parameter... needed to complete the transaction"
This:
authorization_url (which is actually critical for completing the payment)The developer doesn't see the full picture or what happens after initialisation.
What should have been said:
"After this → redirect user → payment happens"
The "Don't use your secret key…" section:
This feels poorly placed.
Before a customer can make a payment, you need to create a transaction.
When you are initialising a transaction, you are telling Paystack:
Follow these steps from your backend to keep your secret key secure.
To initialise a transaction, send a POST request to Paystack's API from your server:
curl -X POST https://api.paystack.co/transaction/initialize -H "Authorization: Bearer YOUR_SECRET_KEY" -H "Content-Type: application/json" -d '{
"email": "customer@email.com",
"amount": 500000
}' This request creates a new transaction for the specified customer and amount.
Paystack returns a response containing important details about the transaction.
Inside the data object, you'll find:
authorization_url: This is the link where the customer completes the payment.reference: A unique ID for tracking the transaction.access_code: Used internally to verify and manage the transaction.To complete the payment, redirect the customer to the authorization_url.
This takes them to Paystack's secure payment page, where they can enter their payment details.
Always initialise transactions from your backend. Never call Paystack's API directly from your frontend, as this would expose your secret key. Instead, your frontend should communicate with your server, which then makes the request to Paystack.
Unlike Paystack's, this version: