Skip to main content
Every endpoint takes a secret key as a bearer token:

Key types

A secret key can move money and read customer identity data. Never ship one in a mobile app, browser bundle, or public repository. If one leaks, roll it in the dashboard immediately.

Live and test keys

Each account has a separate live and test key. The base URL is the same for both — the key alone decides whether a request is live. There is no sandbox hostname. See Environments for what that means in practice.

Errors