Skip to main content
Every call to the Orchestrate API is authenticated with a secret key sent as a bearer token.

​
Keys and environments

A secret key looks like sk_{environment}_{id}_{secret}, where the environment is either live or sandbox. The key carries the environment. There is no environment header, no query parameter and no separate base URL — the same endpoint behaves differently depending on which key you present. Data is isolated: a sandbox key never sees live payments, and the reverse. Going live is a key swap and nothing else.
Secret keys act on behalf of your project without further checks. Keep them server-side, in environment variables or a secret manager. Never ship one to a browser, a mobile app or a public repository.

​
Managing keys

Keys are created, rotated and revoked in your dashboard. A key can be deactivated or given an expiry date; either makes it stop working immediately. To rotate without downtime: create the new key, deploy it, then revoke the old one.

​
IP allowlist

A key can be restricted to a set of source addresses. When an allowlist is set, a request from any other address is rejected with 403, even if the key itself is valid. Configure the allowlist in the dashboard.

​
Errors

See Errors for the full list and the response shape.