Authentication - One Pay

Every request carries your secret key in the Authorization header:

Authorization: Bearer sk_test_...

Key starts with	Mode	Moves real money
`sk_test_`	Test	Never
`sk_live_`	Live	Yes

The key decides the mode: a test key only ever sees test payments and test balances, and a live key only live ones.

Keeping keys safe

A secret key can move your money. Keep it on your server only: never in a mobile app, a web page or a public repository.

Keys are shown once, when created. One Pay keeps only a fingerprint and cannot show a key again: create a new one, then revoke the old one.
Create keys per app (a website, a mobile app’s backend, a service) in the dashboard’s API keys & webhooks page. Revoking one stops it at once without touching the others.
Live keys can be created once your business is verified.

When a key is refused

Situation	HTTP	`code`
No key sent	401	`api_key_missing`
Unknown or malformed key	401	`api_key_invalid`
Revoked key	401	`api_key_revoked`
Account suspended	403	`merchant_suspended`

{
  "error": {
    "code": "api_key_missing",
    "message": "Send your API key in the Authorization header: Bearer sk_test_...",
    "request_id": "req_c218fd97ddd178aef59bc752"
  }
}

Rate limit

Each key may make 600 requests a minute. Above that, requests are refused with 429 rate_limited for the rest of the minute: wait and retry. Webhooks mean you rarely need to poll.