API keys, OAuth, credential rotation and role-based permissions.
Sandbox secret key: sk_test_••••••••4f2a — shown in full only once at creation.
Production keys: Disabled pending approval.
Keys are stored server-side as hashes only. Never put secrets in browser storage or front-end code. Rotate or revoke at any time; old keys stop working immediately.
Authorization: Bearer sk_test_... or an OAuth 2.0 client-credentials token. Every key is scoped to one merchant and a set of permissions such as payments:write. All requests are recorded in the audit log.