Authentication

One secret key per environment, sent as a Bearer token on every request.

Authorization: Bearer sk_live_mMKKS4URYva…   # real money
Authorization: Bearer sk_test_mMKKS4URYva…   # sandbox

Key facts

  • Keys are issued by PrimCard and shown exactly once — we store only a hash and cannot recover a lost key. Losing one means issuing a new one.
  • The key's prefix selects the environment: sk_test_ operates a completely separate balance and card set with no real money; sk_live_ is production. Same endpoints, same code.
  • Rotation without downtime: both keys can be active at once — deploy the new one, then ask us to revoke the old. A revoked key fails with 401 immediately.
  • Rate limits: 120 requests/minute per key, 30 money-moving requests/minute per account.429 responses include Retry-After.

Handling your key

Treat sk_live_ keys like the money they control. Server-side only — never in a browser, mobile app, or repository. Use an environment variable. If a key may have leaked, contact PrimCard immediately and we revoke it on the spot.