Send your complete merchant secret in the x-api-key header. Portal-created Sandbox keys start with tg_test_; Production keys start with tg_live_. Keep them in your backend’s secret store, never browser code, mobile apps, URLs or source control.
Your key determines the merchant and permissions. Your tenant and product must be active, and configured IP restrictions apply to your server’s outbound IP. Revoked, expired or wrong-mode keys are rejected.
These merchant endpoints use API keys, not your portal passkey, Firebase user token or App Check. The hosted checkout handles its own customer access; do not build against its private browser endpoints.
Manage keys in the portal. Portal-issued keys support only orders_read and orders_write; privileged credential administration endpoints are outside this public reference.
Keys default to 90 days, with a maximum of one year. Rotate by creating a replacement, updating your backend, then explicitly revoking the old key.
