test_pkTest public
Catalogue and delivery-location reads during development.
Authentication and keys
Every request uses an apiKey header. The key identifies the merchant application and selects test or live mode.
Four keys per app
test_skTest secret
Quotes, orders, wallet, and order data using test funds.
live_pkLive public
Production catalogue and delivery-location reads.
live_skLive secret
Production checkout and private merchant data.
Route permissions
| Capability | Public key | Secret key |
|---|---|---|
| Product and filter reads | Allowed | Allowed |
| Delivery location reads | Allowed | Allowed |
| Create delivery quote | Denied | Required |
| Create order | Denied | Required |
| Read orders or wallet | Denied | Required |
Key handling
Public keys may be used in storefront clients. Secret keys belong in a server-side secret manager or protected runtime environment variable. Restrict who can reveal or rotate them, redact request headers from logs, and never send them to error monitoring.
Rotation
Rotating keys invalidates the old pair immediately. Deploy consumers of the new key together or use a controlled maintenance window. Test and live pairs rotate independently.
Authentication errors
Missing or invalid keys return 403. A public key on a secret-only route also returns 403. Product routes additionally reject wallets below the minimum service balance, so treat a low-balance response as operational rather than an authentication retry.