API authentication and allowlists
Use a server-side Bearer API key and IP/CIDR allowlist for sandbox and production aggregation API requests.
Bearer API key
Send your API key in the Authorization header. Sandbox access uses a test key; live access uses a production key. The sandbox endpoint is sent with your sandbox key.
Authorization: Bearer <API_KEY>
Content-Type: application/jsonServer-side only
Never include your API key or webhook secret in browser code, public repositories, client-side storage or URLs. Make API requests from your server.
IP/CIDR allowlist
Configure the IP/CIDR allowlist for the servers making API requests. Use the configuration details supplied with your key.
Full reference
Full field reference is included with your sandbox key. Authentication errors, configuration fields and rate limits are provided there.