Authentication

How to authenticate requests to the Pesarc API.

Pesarc developer endpoints authenticate with a secret key sent as a bearer token:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx

Each merchant has their own key, so a verified key also tells Pesarc which account to scope the request to.

Getting a key

• In the app — open Developers and create a key. The full secret is shown once; copy it right away.
• Over the API — see API keys.

Keeping keys safe

Your secret key can move money and read your account. Protect it:

• Keep it server-side only — never in browser or mobile client code.
• Never commit it to source control; load it from an environment variable.
• Rotate immediately if it may have leaked: revoke the old key and create a new one in Developers.

Missing or invalid keys

A request with no key returns 401:

{
  "error": {
    "type": "authentication_error",
    "message": "Missing API key. Send Authorization: Bearer sk_live_…"
  }
}

An invalid or revoked key also returns 401. Confirm a key quickly with GET /v1/ping.