Skip to content
PachaPayPachaPayPachaPay Docs
Draft: the API is under development and may change before the first release

Authentication

Send a secret project key in the Authorization header:

Authorization: Bearer sk_test_...
Prefix Mode
sk_test_ test mode
sk_live_ live mode
  • The sk_ prefix means a secret server-side key. Never embed it in a browser or mobile app.
  • Keys are bound to a project.
  • Keys are stored hashed. A lost key is replaced, not recovered.
  • A live key used before the merchant passes KYB returns 403 merchant_not_active. See Going live.
  • Request signing is not required in the MVP. Webhooks are always signed: see Webhooks.

Invalid or revoked keys return 401 with api_key_invalid or api_key_revoked. See Errors.