# Authentication

PaySwitch uses API keys in the `api-key` HTTP header for merchant server requests.

## Secret API key

- Used for **server-to-server** calls (`POST /payments`, `POST /refunds`, etc.).
- Environment-specific prefix (`snd_` for test, `prod_` for live).
- Created in Dashboard → **Developers** → **API Keys**.

```bash
curl -X POST 'https://your-router.example.com/payments' \
  -H 'Content-Type: application/json' \
  -H 'api-key: snd_your_secret_key' \
  -d '{ "amount": 1000, "currency": "USD" }'
```

**Never** embed the secret API key in frontend code, mobile apps, or public repositories.

## Publishable key

- Used by the **Web SDK** / client-side integration.
- Safe to expose in the browser.
- Passed when initializing the checkout widget.

## Admin API key

Some account-management operations require an **admin API key** configured on the PaySwitch router deployment. This key is **not** generated from the merchant Dashboard. Contact your platform operator if you need admin-level API access.

## Errors

| HTTP code | Typical cause |
| --------- | ------------- |
| `401` | Missing or invalid `api-key` |
| `403` | Valid key but insufficient scope for the resource |