> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.stakaba.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.stakaba.com/_mcp/server.

# Authentication

## API keys

All payment endpoints use an `x-api-key` header. You get two keys from your dashboard:

| Key                             | Purpose                       |
| ------------------------------- | ----------------------------- |
| **Sandbox key** (`sk_test_...`) | Testing — no real money moves |
| **Live key** (`sk_live_...`)    | Production — real payments    |

```http
POST /api/v1/payments/collection
x-api-key: sk_test_your_key_here
Content-Type: application/json
```

> **Warning**
>
> Never put your API key in frontend JavaScript, mobile app source code, public repositories, or logs. Always call the Stakaba API from your server.

## Getting your API key

1. Sign in to [app.stakaba.com](https://app.stakaba.com)
2. Go to **Settings → API Keys**
3. Copy your sandbox key to start testing
4. After go-live approval, your live key will be available in the same place

## Rotating keys

If a key is compromised, rotate it immediately:

```
POST /api/v1/merchants/me/keys/rotate
```

This invalidates the old key and issues a new one instantly.

## Sandbox vs live

The same API handles both. The key you send determines which mode runs:

* Sandbox key → simulated payments, no charges to anyone
* Live key → real money moves, requires an approved merchant account

Test thoroughly in sandbox before switching to live.