> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pesarc.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Pesarc API.

Pesarc developer endpoints authenticate with a **secret key** sent as a bearer
token:

```
Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx
```

Each merchant has their own key, so a verified key also tells Pesarc **which
account** to scope the request to.

## Getting a key

* **In the app** — open **Developers** and create a key. The full secret is shown
  **once**; copy it right away.
* **Over the API** — see [API keys](/api-reference/keys).

## Keeping keys safe

<Warning>
  Your secret key can move money and read your account. Protect it:

  * Keep it server-side only — never in browser or mobile client code.
  * Never commit it to source control; load it from an environment variable.
  * Rotate immediately if it may have leaked: revoke the old key and create a new
    one in **Developers**.
</Warning>

## Missing or invalid keys

A request with no key returns `401`:

```json theme={null}
{
  "error": {
    "type": "authentication_error",
    "message": "Missing API key. Send Authorization: Bearer sk_live_…"
  }
}
```

An invalid or revoked key also returns `401`. Confirm a key quickly with
[`GET /v1/ping`](/api-reference/ping).