> ## Documentation Index
> Fetch the complete documentation index at: https://docs.primepay.mw/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate PrimePay API requests with a bearer API key.

Send your API key as a bearer token on every request:

```http theme={null}
Authorization: Bearer sk_live_...
```

## Key types

| Key | Starts with | Can do |
| - | - | - |
| Publishable | `pk_live_` / `pk_test_` | Read-only reference data, such as the operators list. Safe in a browser. |
| Secret (full) | `sk_live_` / `sk_test_` | Everything: payments, transfers, lookups. Keep it on your server. |
| Payments-only | `rk_live_` / `rk_test_` | Payments only. Only issued after PrimePay approves an exemption for your account. |

## Server IP list (live only)

Secret keys only work from the server addresses listed under **Settings › Security** in the [dashboard](https://dashboard.primepay.mw/). Calls from other addresses are refused.

> [!NOTE]
>
> Sandbox calls are never refused for their address, so you can test from your laptop or Postman.

## Authentication errors

| Error code | HTTP | Meaning |
| - | - | - |
| `ip_allowlist_empty` | 403 | Your account has no server addresses listed yet. Add one under Settings › Security. |
| `ip_not_allowed` | 403 | The call came from an address that isn't on your list. The message names the address. |
| `key_scope_payments_only` | 403 | A payments-only key was used for something other than a payment. |
| `invalid_api_key` | 401 | The key is wrong, revoked or missing. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.