> ## Documentation Index
> Fetch the complete documentation index at: https://pay.onemarketc.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secret API keys, sent from your server.

Every request carries your secret key in the `Authorization` header:

```http theme={null}
Authorization: Bearer sk_test_...
```

| Key starts with | Mode | Moves real money |
| - | - | - |
| `sk_test_` | Test | Never |
| `sk_live_` | Live | Yes |

The key decides the mode: a test key only ever sees test payments and test
balances, and a live key only live ones.

## Keeping keys safe

> [!WARNING]
>
> A secret key can move your money. Keep it on your server only: never in a
> mobile app, a web page or a public repository.

* Keys are shown **once**, when created. One Pay keeps only a fingerprint
  and cannot show a key again: create a new one, then revoke the old one.
* Create keys per **app** (a website, a mobile app's backend, a service) in
  the dashboard's **API keys & webhooks** page. Revoking one stops it at
  once without touching the others.
* Live keys can be created once your business is
  [verified](https://pay.onemarketc.com/docs/guides/going-live.md).

## When a key is refused

| Situation | HTTP | `code` |
| - | - | - |
| No key sent | 401 | `api_key_missing` |
| Unknown or malformed key | 401 | `api_key_invalid` |
| Revoked key | 401 | `api_key_revoked` |
| Account suspended | 403 | `merchant_suspended` |

```json theme={null}
{
  "error": {
    "code": "api_key_missing",
    "message": "Send your API key in the Authorization header: Bearer sk_test_...",
    "request_id": "req_c218fd97ddd178aef59bc752"
  }
}
```

## Rate limit

Each key may make **600 requests a minute**. Above that, requests are
refused with `429 rate_limited` for the rest of the minute: wait and retry.
Webhooks mean you rarely need to poll.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.