" %}
{% tabs %}
{% tab title="Bash" %}
# Using wget
wget https://cdn.akashicpay.com/secureapi-mainnet-ca.pem
# Using curl
curl -o https://cdn.akashicpay.com/secureapi-mainnet-ca.pem
{% endtab %}
{% tab title="PowerShell" %}
{% code overflow="wrap" %}
```powershell
Invoke-WebRequest -Uri "https://cdn.akashicpay.com/secureapi-mainnet-ca.pem" -OutFile "secureapi-mainnet-ca.crt"
```
{% endcode %}
{% endtab %}
{% endtabs %}
**Testnet Environment:**
{% file src="" %}
{% tabs %}
{% tab title="Bash" %}
# Using wget
wget https://cdn.akashicpay.com/secureapi-testnet-ca.pem
# Using curl
curl -o https://cdn.akashicpay.com/secureapi-testnet-ca.pem
{% endtab %}
{% tab title="PowerShell" %}
{% code overflow="wrap" %}
```powershell
Invoke-WebRequest -Uri "https://cdn.akashicpay.com/secureapi-testnet-ca.pem" -OutFile "secureapi-testnet-ca.crt"
```
{% endcode %}
{% endtab %}
{% endtabs %}
The root certificates are displayed when accessing the root of the SecureAPI and are different for both testnet and mainnet SecureAPI for example:
{% code overflow="wrap" %}
```json
"ca": "-----BEGIN CERTIFICATE-----\nMIIDuzCCAqOgAwIBAgIUInIGFng78Xd/UMo3Fz1fg1FnasIwDQYJKoZIhvcNAQEL\nBQAwbTELMAkGA1UEBhMCVUsxDzANBgNVBAgMBkxvbmRvbjEPMA0GA1UEBwwGTG9u\nZG9uMRMwEQYDVQQKDApOb3RhYm94IENBMQ0wCwYDVQQLDARSb290MRgwFgYDVQQD\nDA9Ob3RhYm94IFJvb3QgQ0EwHhcNMjUwNzI4MTEzOTUwWhcNMzAwNzI3MTEzOTUw\nWjBtMQswCQYDVQQGEwJVSzEPMA0GA1UECAwGTG9uZG9uMQ8wDQYDVQQHDAZMb25k\nb24xEzARBgNVBAoMCk5vdGFib3ggQ0ExDTALBgNVBAsMBFJvb3QxGDAWBgNVBAMM\nD05vdGFib3ggUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nAN9Fv2fRVjSu+NVwl1x6ouuPAvRa/8pdABHaGm+qSx1utW4BZwozO4V35XZlmo8m\nQiif4mrBOSTN22VbjNc9ajIbAucFTEZHyN7Mv1cgGC7loTWfZmmMicXdRSeMasvH\nQGefuMDxFiwrg+Aj+FT6qwaDaoBkmIeOpZHFzactrtZMLyRHH5Hky2H9pEJ9CYR7\n1KbKhI52R65N/NgECgFosRnXWwV30WlGk0g6BbhyyQoIcZZG9WDcyNpu/ZCLNjNW\nxIjansyR6OdNgC2KVYrrrFqQ+DwlzB7ogvXIOzJNyCVufrItOGvs/eNDtSdSkI0h\nPZACfmBM5+hBeUKzuBGyuV8CAwEAAaNTMFEwHQYDVR0OBBYEFDXjLj2c5FU4is17\nx1r0mCOlAePgMB8GA1UdIwQYMBaAFDXjLj2c5FU4is17x1r0mCOlAePgMA8GA1Ud\nEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBANaWKZb19Ztp7fBHMfhT3Hcb\n3TPQTZlxvaTdChBL0EDA0fYPqE0mNNYVDoh0vHBCK0cQJMuIHaZfwBHTPl5igou1\nNbT+PhxjgWfsCva0t3ckiz0XBJ6j4gDuVzcOsPDuW6HWi9vMde7t6bwAfDCDPvtr\n7kBNIkZvIxAJroNrSvVtyQo6PyGS6zS5SIPz5togRsNv0TWKzMNPEayxIxhWoKMa\n/rrVo3WhFlW+IMjzznzDNIZ8cclNRUkm+YvA9aR9fOJ6Kz5/pstm4KgVB86GCD2v\nFtp8knq0WSQEFWmj6lcZEi/ttpxR/5hvXWUL3bJWVqQQWODNfplnWpYnOzPyIL4=\n-----END CERTIFICATE-----\n"
```
{% endcode %}
You may verify the root certificate matches with the files above, and install them once.
### Root CA Installation
**Operating System Installation**
{% tabs %}
{% tab title="macOS" %}
{% code overflow="wrap" %}
```bash
# Download the certificate
curl -o https://cdn.akashicpay.com/secureapi-mainnet-ca.pem
# Install to System Keychain
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain secureapi-mainnet-ca.pem
# For user keychain (alternative)
security add-trusted-cert -d -r trustRoot -k ~/Library/Keychains/login.keychain secureapi-mainnet-ca.pem
```
{% endcode %}
{% endtab %}
{% tab title="Ubuntu/Debian" %}
{% code overflow="wrap" %}
```bash
# Download the certificate
wget https://cdn.akashicpay.com/secureapi-mainnet-ca.pem
# Install to system certificate store
sudo cp secureapi-mainnet-ca.pem /usr/local/share/ca-certificates/secureapi-mainnet-ca.pem
sudo update-ca-certificates
```
{% endcode %}
{% endtab %}
{% tab title="CentOS/RHEL/Fedora" %}
{% code overflow="wrap" %}
```bash
# Download the certificate
wget https://cdn.akashicpay.com/secureapi-mainnet-ca.pem
# Install to system certificate store
sudo cp secureapi-mainnet-ca.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust
```
{% endcode %}
{% endtab %}
{% tab title="Windows" %}
{% code overflow="wrap" %}
```powershell
# Download the certificate
Invoke-WebRequest -Uri "https://api.akashicpay.com/secureapi-mainnet-ca.pem" -OutFile "secureapi-mainnet-ca.crt"
# Install to certificate store (run as Administrator)
Import-Certificate -FilePath "secureapi-mainnet-ca.crt" -CertStoreLocation Cert:\LocalMachine\Root
```
{% endcode %}
{% endtab %}
{% endtabs %}
**Browser Installation**
{% tabs %}
{% tab title="Chrome/Edge" %}
1. Download the CA certificate
2. Open Chrome Settings → Privacy and Security → Security → Manage Certificates → Local certificates → Customised (Installed by you)
3. Import the certificate to "Trusted certificates"
{% endtab %}
{% tab title="Firefox" %}
1. Download the CA certificate
2. Open Firefox Settings → Privacy & Security → View Certificates
3. Import the certificate to "Authorities" tab
{% endtab %}
{% endtabs %}
#### Using the Certificate in Code
After downloading the CA certificate you may specify it in your code.
{% tabs %}
{% tab title="cURL" %}
```bash
curl --cacert secureapi-mainnet-ca.pem \
-H "x-ap-k: your-private-key" \
-H "x-ap-a: your-l2-address" \
https:///getBalance
```
{% endtab %}
{% endtabs %}
## Best Practices
1. **Rate Limiting**: Adhere to API rate limits (contact [AkashicPay Support](https://t.me/akashicpay_support_bot) for details). Implement exponential backoff for retries to avoid overwhelming the server.
2. **Error Handling**: Always handle errors gracefully. Check for specific error codes (e.g., `FUNDS_EXCEEDED`, `INVALID_PARAMETER`) and provide user-friendly messages or fallback actions.
3. **Security**: Store private keys securely (e.g., in environment variables or a secrets manager). Regularly verify the API using the **Verify** and **Attestation** endpoints to ensure the service matches the open-source code.
4. **Parameter Validation**: Validate all inputs (e.g., `network`, `token`, `amount`) against the defined `NetworkSymbol`, `TokenSymbol`, and `Currency` values before making requests to avoid `INVALID_PARAMETER` errors.
5. **Pagination**: Use `page` and `limit` parameters for endpoints like `GET /getTransfers` to manage large datasets efficiently.
6. **Testing**: Test on Testnet environments (e.g., `Ethereum_Sepolia`, `Tron_Shasta`, `Binance_Smart_Chain_Testnet`, `Solana_Devnet`) before deploying to Mainnet to ensure correctness.
## Notes
1. All API requests must include proper authentication headers (`x-ap-k` and `x-ap-a`).
2. For production access, contact [AkashicPay Support](https://t.me/akashicpay_support_bot) to whitelist your IP addresses.
3. All amounts should be passed as strings to avoid precision issues.
4. Ensure that parameters like `network`, `requestedCurrency`, `token`, `layer`, and `status` match the defined `NetworkSymbol`, `Currency`, `TokenSymbol`, `TransactionLayer`, and `TransactionStatus` values, respectively.
5. Periodically verify the API's security using the **Verify** and **Attestation** endpoints to ensure the service is running as expected and matches the open-source code.
1. Run the latest AkashicPay SecureAPI code from our open-source repository locally, then navigate to `/verify/your-secret` to confirm that the `calculated` hash matches the one displayed on our server at `/verify/your-secret`.