Authentication

Server-to-server integrations use API keys. Dashboard routes use session cookies.

Test keys — tp_test_…

Sandbox data, simulate payment, and pl_test_ payment links. Use during development.

Live keys — tp_live_…

Real payments after merchant verification. Keys must match the project environment (TEST vs LIVE).

Request headers

Send your API key as a Bearer token or via X-API-Key. Keys are scoped to one project — the URL :projectIdmust match the key's project.

Context	Method
Dashboard (browser)	NextAuth session cookie
Server-to-server	Authorization: Bearer tp_test_xxxxxxxxxxxxxxxx
Alternative	X-API-Key: tp_test_xxxxxxxxxxxxxxxx

Verify credentials

GET/api/v1/merchant

Returns merchant account details for the authenticated key or session.

Auth: Session or API key

Example

curl -s "https://pay.andgroupco.com/api/v1/merchant" \
  -H "Authorization: Bearer tp_test_xxxxxxxxxxxxxxxx"

API key scopes

Keys are created in the dashboard (session auth only) with granular permissions. Common scopes:

orders:read / orders:write
payments:read / payments:write
webhooks:read / webhooks:write

Merchant verification

New merchants must complete business verification before write payment APIs. Unverified requests return merchant_not_verified (403). Configure collection QR, keys, and webhooks while pending.