Start building

Keys & authentication

Authenticate server requests and keep sandbox and live traffic separate.

Use a server API key

Create a key in Dashboard → API keys. The secret is shown once. Store it in a server environment variable and send it as a Bearer token on every public API request.

The public API uses /api/v1. Dashboard session authentication is separate and is not used for merchant integrations.

request headers

GET https://api.veyqo.org/api/v1/payments
Authorization: Bearer <your-server-api-key>
Content-Type: application/json

Grant the scopes you need

Operation	Required scope
Create payments or checkout sessions	payments:write
Read or verify payments; list providers	payments:read
Create refunds	refunds:write
Read refunds	refunds:read
Read normalized events	events:read

One key, one environment

A sandbox key can access its sandbox resources; a live key can access its live resources. Connect the provider and configure webhooks separately for each environment. A key with the right scope still cannot cross the environment boundary.

Never place a secret API key in browser code, a public repository, a prompt, or client-side VITE_ variables. The checkout script’s publishable key is a different credential.