Authentication

Every API call authenticates with a bearer API key in the Authorization header.

Bearer keys

Authorization: Bearer ak_live_9f2c…

Keys are tenant-scoped: a key can only read and write its own merchant’s resources. Never expose a live key in client-side code — all calls are server-to-server.

Signed requests (optional)

Deployments that require it can additionally enforce an HMAC signature over each request. When enabled, you send an X-Signature header of the form v1=HMAC-SHA256(secret, canonicalString). If your deployment is bearer-only, no signature is required.

Errors

A missing or invalid key returns 401 with a stable error code. See error codes.