Getting Startedv1
Authentication
Authenticate API requests and protect application credentials.
Updated 12/07/2026
On this page
Bearer credentials
Send the application credential in the Authorization header using the Bearer scheme.
http
Authorization: Bearer <api_key>Credential safety
Keep credentials in backend secret storage, never browser code.
Use sandbox credentials only with sandbox endpoints.
Assign the minimum required scopes.
Rotate credentials regularly and revoke a credential immediately if exposure is suspected.
Never include credentials in logs, support messages, URLs, or screenshots.
Rotation
Create a replacement credential, update the integration, verify successful traffic, and then revoke the previous credential. Audit logs record creation, rotation, and revocation events.