Authentication

One header, on every request:

Authorization: Bearer sk_live_xxxxxxxxxxxx
Accept: application/json
Content-Type: application/json      <- POST only

sk_test_... operates in sandbox; sk_live_... in production. The routes are identical: the environment is determined solely by the key prefix.
The secret key is server-side only. Never in a browser, a mobile app, a repository or a log.
A publishable key (pk_...) also exists in the portal. The payment-link flow does not use it today; it is intended for future browser-side integrations.

Authentication errors (two distinct messages, useful for diagnosis):

Situation	HTTP	`message`
Header missing	401	`Encabezado Authorization ausente o invalido. Use: Bearer sk_test_... o Bearer sk_live_...`
Key invalid or revoked	401	`Clave API invalida.`