Authentication

Send your secret key as a bearer token on every request.

Authorization: Bearer sk_test_…

• Keys belong to a project. Everything you create with a key belongs to that project, and so does the uniqueness of your reference and your idempotency keys.
• sk_test_ keys work in test mode and sk_live_ keys in live mode. Every object and webhook says which one it is in its mode field. A live key on a test deployment, or the other way round, is refused with 403 mode_mismatch.
• A missing, revoked or unknown key is 401 api_key_invalid.
• Call the API from your server only. A secret key in a browser or a mobile app is a leaked key.
• Create, rotate and revoke keys in the dashboard. Rotate a key you may have exposed straight away.