Authentication

Every endpoint except public tracking, the public rate check and the public status endpoint needs an API key. Send it as a bearer token in the Authorization header:

Authorization: Bearer SB_51H8f2K9pLmQ7xR3vT6wY0zA4bC8dE2f

Send JSON bodies with Content-Type: application/json.

Getting a key

• Sandbox: a sandbox key is created for you automatically when you verify your email and finish onboarding in the merchant dashboard.
• Production: once your business is approved (KYB) and go-live is enabled, create a production key from API Keys in the dashboard.

A key is shown once, when it is created. It cannot be retrieved again, only revoked and replaced, and we never email raw keys. You can have up to 5 active keys per environment, which makes it easy to rotate keys without downtime.

Key prefixes and environments

The environment of a request comes from the key alone, never from the URL or a request parameter. The same paths serve both environments, so you switch by loading a different key. A sandbox key can never read or change production data, and a production key can never touch sandbox data.

Production access

Production keys work only after your business verification (KYB) is approved and your account is enabled to go live. Until then, production requests return 403 permission_error:

{
  "success": false,
  "error": {
    "code": "permission_error",
    "message": "Production access has not been approved for this account yet. Use a sandbox key (SB_...) until go-live is approved."
  }
}

Authentication errors

{
  "success": false,
  "error": {
    "code": "authentication_error",
    "message": "Invalid or revoked API key."
  }
}

Keeping keys safe

• Store keys in environment variables or a secrets manager, never in source control.
• Call the API from your backend only. Never put a key in a mobile app, a browser or a public repository.
• Rotate keys by creating a new key, deploying it, then revoking the old one.
• If a key leaks, revoke it from the dashboard straight away. Revocation applies from the very next request.