> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orqex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secret keys, environments and access control.

Every call to the Orchestrate API is authenticated with a secret key sent as a bearer token.

```bash theme={null}
curl https://api.orqex.com/v1/payment/intents \
  -H "Authorization: Bearer sk_live_..."
```

## Keys and environments

A secret key looks like `sk_{environment}_{id}_{secret}`, where the environment is either
`live` or `sandbox`.

The key carries the environment. There is no environment header, no query parameter and no
separate base URL — the same endpoint behaves differently depending on which key you
present. Data is isolated: a sandbox key never sees live payments, and the reverse.

|                |                                                                             |
| -------------- | --------------------------------------------------------------------------- |
| `sk_sandbox_…` | No real money. The built-in [test gateway](/payments/testing) is available. |
| `sk_live_…`    | Real money.                                                                 |

Going live is a key swap and nothing else.

<Warning>
  Secret keys act on behalf of your project without further checks. Keep them server-side,
  in environment variables or a secret manager. Never ship one to a browser, a mobile app
  or a public repository.
</Warning>

## Managing keys

Keys are created, rotated and revoked in your [dashboard](https://app.orqex.com). A key can
be deactivated or given an expiry date; either makes it stop working immediately.

To rotate without downtime: create the new key, deploy it, then revoke the old one.

## IP allowlist

A key can be restricted to a set of source addresses. When an allowlist is set, a request
from any other address is rejected with `403`, even if the key itself is valid. Configure
the allowlist in the dashboard.

## Errors

| Status | Meaning                                                                             |
| ------ | ----------------------------------------------------------------------------------- |
| `401`  | No key was sent, or the key is invalid, inactive or expired.                        |
| `403`  | The key is valid but the request came from an address that is not on its allowlist. |

See [Errors](/errors) for the full list and the response shape.