> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oyapasteaza.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate your requests to the Pasteaza API with API keys.

Pasteaza authenticates API requests with API keys. Include your secret key in the `Authorization` header for every server-side request.

<Info>
  Keep your secret key on your backend server. Never expose it in frontend code, mobile apps, Git repositories, or public logs.
</Info>

## API keys

Pasteaza issues separate keys for test mode and live mode. Use test keys while you build and live keys when you are ready to process real transactions.

| Key type   | Test mode                   | Live mode                   | Use                                              |
| ---------- | --------------------------- | --------------------------- | ------------------------------------------------ |
| Public key | `pk_test_xxxxxxxxxxxxxxxxx` | `pk_live_xxxxxxxxxxxxxxxxx` | Client-side integrations and checkout components |
| Secret key | `sk_test_xxxxxxxxxxxxxxxxx` | `sk_live_xxxxxxxxxxxxxxxxx` | Backend API requests                             |

## Authenticate a request

Send your secret key as a bearer token in the `Authorization` header.

```http theme={null}
Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxx
```

<Steps>
  <Step title="Choose the correct environment">
    Use a test secret key for sandbox requests. Use a live secret key only when you want to process real transactions.
  </Step>

  <Step title="Add the authorization header">
    Include the `Authorization` header with each backend API request.

    ```http theme={null}
    POST /v1/collections/virtual-accounts HTTP/1.1
    Host: api.oyapasteaza.com
    Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxx
    Content-Type: application/json
    ```
  </Step>

  <Step title="Send the request from your server">
    Make authenticated requests from your backend so your secret key stays private.
  </Step>
</Steps>

## Example request

```bash theme={null}
curl https://api.oyapasteaza.com/v1/collections/virtual-accounts \
  -X POST \
  -H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "merchantReference": "COL-10001",
    "amount": 500000
  }'
```

## Test mode

Use your `sk_test_` key to create and test payments without moving real funds. Requests made with test keys run in the sandbox environment.

<Tip>
  Start with test mode when you build your integration. Switch to live mode only after you have tested collections, disbursements, webhooks, and idempotency.
</Tip>

## Live mode

Use your `sk_live_` key to process real transactions. Store your live secret key securely and restrict access to trusted backend services only.

## Related security features

<CardGroup cols={2}>
  <Card title="Webhook verification" icon="shield-check" href="/getting-started/webhooks">
    Verify the `X-Pasteaza-Signature` header before trusting webhook payloads.
  </Card>

  <Card title="Idempotency" icon="rotate" href="/getting-started/idempotency">
    Use the `Idempotency-Key` header to prevent duplicate requests.
  </Card>
</CardGroup>

## Security best practices

* Keep secret keys out of frontend and mobile applications.
* Store API credentials in a secure secrets manager or encrypted environment variables.
* Rotate API keys periodically and after any suspected exposure.
* Verify every webhook signature before updating transaction state.
* Use HTTPS for every request to the Pasteaza API.