Authentication

One bearer key per environment.

HTTP

Authorization: Bearer sk_live_...

Keys#

Prefix	Environment	`livemode`
`sk_test_`	Test	`false`
`sk_live_`	Live	`true`

Test and live data never mix. Every response carries livemode — check it.

Sandbox#

sk_test_ keys run against payout-partner sandboxes. No real money moves.

Same base URL, same endpoints, same responses.
Test objects never appear in live, and live objects never appear in test.
Going live is a key swap.

Rules#

Server-side only. Never ship a key to a browser or mobile app.
Store in a secret manager, not source control.
Leaked a key? Email hello@withsuperpay.com to rotate it.

Failures#

JSON

{
  "object": "error",
  "errors": [
    { "code": "secret_key_invalid", "message": "Invalid API key.", "metadata": null }
  ],
  "http_status_code": 401
}

Code	HTTP	Cause
`secret_key_invalid`	401	Header missing, malformed, or key unknown
`action_unauthorized`	401 · 403	Key is valid but not allowed to do this