Authentication
API keys, environments and permissions.
Every request carries an API key as a bearer token:
Authorization: Bearer sw_test_…- The key decides the environment:
sw_test_…keys work on test data only,sw_live_…keys on live data only. No request field can switch environment. - A key carries permissions (for example
payments:write). Each endpoint in the API reference names the one it needs; a key without it getsPERMISSION_DENIED. - Keys are shown once, when you create them in the merchant portal. Keep them on your server only — never in a browser, an app or a repository. If one leaks, revoke it and create another.
A missing, unknown or revoked key answers 401 with AUTHENTICATION_FAILED.