Authentication

One header, on every request:

Authorization: Bearer sk_live_xxxxxxxxxxxx
Accept: application/json
Content-Type: application/json      <- POST only

• sk_test_... operates in sandbox; sk_live_... in production. The routes are identical: the environment is determined solely by the key prefix.
• The secret key is server-side only. Never in a browser, a mobile app, a repository or a log.
• A publishable key (pk_...) also exists in the portal. The payment-link flow does not use it today; it is intended for future browser-side integrations.

Authentication errors (two distinct messages, useful for diagnosis):