Authentication

Send your API key in the x-api-key header on every request, exactly once.

x-api-key: pk_live_3f9a…
Content-Type: application/json

Keys

Key	Use
`pk_test_…`	Test mode. No card is charged and no money moves.
`pk_live_…`	Live payments.

Create keys in your merchant dashboard. A new key must be approved before it works.

Keep your API key on your server. Never put it in a web page or a mobile app.

HTTP	errorCode	Meaning
401	`API_KEY401_INVALID`	Missing, malformed or unknown API key.
403	`API_KEY403_NOT_ACTIVE`	Key pending, inactive or suspended.
403	`API_KEY403_REVOKED`	Key permanently rejected.
403	`MERCHANT403_INACTIVE`	Merchant account not active.

The webhook signing secret is separate from your API key. Set it in the dashboard API settings. See Verify the signature.