Authentication

Send your API key as a bearer token on every request:

Authorization: Bearer sk_live_...

Key types

Key	Starts with	Can do
Publishable	`pk_live_` / `pk_test_`	Read-only reference data, such as the operators list. Safe in a browser.
Secret (full)	`sk_live_` / `sk_test_`	Everything: payments, transfers, lookups. Keep it on your server.
Payments-only	`rk_live_` / `rk_test_`	Payments only. Only issued after PrimePay approves an exemption for your account.

Secret keys only work from the server addresses listed under Settings › Security in the dashboard. Calls from other addresses are refused.

Sandbox calls are never refused for their address, so you can test from your laptop or Postman.

Error code	HTTP	Meaning
`ip_allowlist_empty`	403	Your account has no server addresses listed yet. Add one under Settings › Security.
`ip_not_allowed`	403	The call came from an address that isn’t on your list. The message names the address.
`key_scope_payments_only`	403	A payments-only key was used for something other than a payment.
`invalid_api_key`	401	The key is wrong, revoked or missing.