API ReferenceAuthentication
Authentication
How every endpoint authenticates : bearer keys, headers, and scopes.
All endpoints authenticate the same way:
Authorization: Bearer <secret_key>| Key prefix | Environment | Use |
|---|---|---|
sk_test_ | Sandbox | Full API, simulated providers |
sk_live_ | Live | Full API, real money |
Required headers per request type
| Header | When | Purpose |
|---|---|---|
Authorization | Every request | Bearer secret key |
Idempotency-Key | All money-moving POSTs | Replay-safe mutations |
Content-Type | Any request with a JSON body | application/json |
Code Example
curl https://api.ouipay.com/v1/customers \
-H "Authorization: Bearer sk_test_..."Errors
| HTTP | error.code | Cause |
|---|---|---|
| 401 | UNAUTHENTICATED | Missing, malformed, or revoked key |
| 403 | FORBIDDEN | Valid key, disallowed scope or IP |
See Getting started → Authentication for rotation and IP allowlisting.