Docs / Authentication
Authenticate every request Tenant API keys scope requests and payment records to one integration.
Send the raw tenant key in the x-api-key header on every /v1 request. Missing, invalid, inactive, or rotated keys return 401.
curl bash Copy curl "${API_URL}/v1/banks" \
--header "x-api-key: ${VEXPAY_API_KEY}"Server-side only Treat the API key as a secret. Load it from a secret manager or server environment variable; do not expose it through NEXT_PUBLIC_ variables.
Live and Test keys Each commercial account has a Live twin and a Test twin. Mode is implied by which key you send. Local seed: `dev-local-api-key` (live) and `dev-local-api-key-test` (test). Webhook payloads include `livemode: true|false`. Default provider is **R4** on both Live and Test. **VPOS** always routes to **BNC** (only capable provider). Test twins keep BNC enabled for VPOS and Portal → Sandbox credentials. Micro-deposits and payouts use **R4** with real céntimos (pair always under Bs 0.50; R4 has no bank sandbox). Confirm the amounts your phone actually received.
A rotated key invalidates the previous key for that mode only (Live or Test). Update the secret in each environment atomically and verify with GET /v1/banks.
