Authentication

Authorization: Bearer sk_test_…

Test and live keys#

The key decides the mode. A key that starts with sk_test_ works only with test data, and one that starts with sk_live_ works only with live data. A test key can never touch live money, and nothing in the request can change that.

Create a key#

Open Settings → API Keys in your dashboard. Test keys are always available. A live key can be created once your business has been approved, and the dashboard asks for your password first. The full key is shown to you in the dashboard; treat it like a password.

Restrict a key to your servers#

Add the IP addresses your servers call from to the key's allowlist in the dashboard. Once a mode has an allowlist, its key works only from those addresses, and a request from anywhere else is refused with 403. Each mode keeps its own list, with room for up to 20 addresses or ranges.

Rotate a key#

When you generate a new key, you choose how long the old one keeps working: not at all, or for 5 or 15 minutes. That window lets you deploy the new key before the old one stops.

What a key can do#

• Start and confirm checkouts, and read your payments.
• List, create, read and update your customers.
• Create, read and update your one-time payment links.
• Create, update, send and cancel your invoices, and read them.

A key cannot move money out, change your settings, manage keys or team members, block a customer, or manage webhook endpoints. Those stay with signed-in members of your team in the dashboard.

If authentication fails#

A missing, invalid or revoked key returns 401. A request from an address that is not on the key's allowlist returns 403. See Errors for the format.