Authenticate with the WAEC Certificate API

All requests to the Digital Certificate Confirmation API must include your Institution API Secret key in the X-DigiCert-Secret request header. There is no token exchange step — you use the key directly.

Generate your API Secret key

Log in to the Digital Certificate platform with your Institution account.
Navigate to your profile settings.
Generate an API Secret key. Copy and store it immediately — the platform will not show it again in full.

Production and sandbox are separate environments, each with its own API Secret key. Generate a key for each environment from your Institution profile. See Environments for the base URLs.

Include the key in requests

Pass the key in the X-DigiCert-Secret header of every API request:

X-DigiCert-Secret: <your_api_secret_key>

curl --request POST \
  --url https://api.smartdocument.org/api/v1/external/certificate/confirm \
  --header 'X-DigiCert-Secret: YOUR_API_SECRET_KEY' \
  --header 'Content-Type: application/json' \
  --data '{ "certificates": [] }'

const response = await fetch(
  'https://api.smartdocument.org/api/v1/external/certificate/confirm',
  {
    method: 'POST',
    headers: {
      'X-DigiCert-Secret': process.env.DIGICERT_SECRET_KEY,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ certificates: [] }),
  }
);

import requests, os

response = requests.post(
    'https://api.smartdocument.org/api/v1/external/certificate/confirm',
    headers={
        'X-DigiCert-Secret': os.environ['DIGICERT_SECRET_KEY'],
        'Content-Type': 'application/json',
    },
    json={'certificates': []},
)

Handling authentication errors

A missing or invalid key returns 401 Unauthorized:

{
    "status": "FAILED",
    "message": "Invalid key provided.",
    "data": null,
    "subCode": null
}

If you receive a 401, verify the key value and confirm it was generated for the correct Institution account.

Keeping your key secure

Your API Secret key grants full access to your Institution account. Never embed it in client-side code, mobile app binaries, or commit it to version control.

Store the key in an environment variable and read it at runtime:

DIGICERT_SECRET_KEY=your_api_secret_key_here

For production deployments, use a dedicated secrets manager such as AWS Secrets Manager or HashiCorp Vault instead of a .env file.

Get Started

Core Concepts

Guides

Configuration

Generate your API Secret key

Include the key in requests

Handling authentication errors

Keeping your key secure

​Generate your API Secret key

​Include the key in requests

​Handling authentication errors

​Keeping your key secure

Generate your API Secret key

Include the key in requests

Handling authentication errors

Keeping your key secure