Authentication

Every request carries your API key in the X-Api-Key header:

X-Api-Key: 2109ebc98a52c66fb73e406b52425b8fa45398cb5a2ebc5e

A request without a key, with a wrong key, or for a merchant the operator has switched off gets 401 unauthorized.

Your keys

You have two secrets:

	What it does
API key	Authenticates your requests to the API.
Callback secret	Signs the callbacks we send to your server, so you can check they are ours.

Both are on the Account page of the merchant portal. They do not change. If one leaks, ask your account manager for new ones.

Keep them on your server

The API key lets anyone create payments as you. Keep both secrets in your server's environment variables: never in client-side code, a mobile app or a public repository.