# Keys & authentication

Authenticate server requests and keep sandbox and live traffic separate.

## Use a server API key

Create a key in Dashboard → API keys. The secret is shown once. Store it in a server environment variable and send it as a Bearer token on every public API request.

The public API uses /api/v1. Dashboard session authentication is separate and is not used for merchant integrations.

```
GET https://api.veyqo.org/api/v1/payments
Authorization: Bearer <your-server-api-key>
Content-Type: application/json
```

## Grant the scopes you need

| Operation | Required scope |
| --- | --- |
| Create payments or checkout sessions | payments:write |
| Read or verify payments; list providers | payments:read |
| Create refunds | refunds:write |
| Read refunds | refunds:read |
| Read normalized events | events:read |

## One key, one environment

A sandbox key can access its sandbox resources; a live key can access its live resources. Connect the provider and configure webhooks separately for each environment. A key with the right scope still cannot cross the environment boundary.

> Never place a secret API key in browser code, a public repository, a prompt, or client-side VITE_ variables. The checkout script’s publishable key is a different credential.