Authentication

Server calls use a secret API key. The browser checkout SDK uses a separate publishable key.

Payment Engine (server)

X-API-KEY: <your-secret-or-legacy-key>

Use a secret key (sk_test_… / sk_live_…) or an existing legacy (unprefixed) key for the target profile. These keys authenticate initiate, status, refunds, subscriptions, and POST /v1/sdk/checkout.

Never put a secret or legacy key in a browser, mobile app, or public repo.

If authentication fails, confirm you are using:

• The Payment Engine host that matches the profile (Sandbox vs Live)
• A key created for that profile
• A key that is still active (not rotated or revoked)

Publishable key (browser)

The JavaScript checkout SDK is activated with a publishable key (pk_test_… / pk_live_…). That key only identifies your merchant. It cannot charge, set an amount, or refund.

Amount still comes from a session your server creates with X-API-KEY. See JavaScript checkout SDK.

Dashboard

Merchant users sign in to the VenPays dashboard with their account credentials. Dashboard session APIs are for the product UI — they do not replace Payment Engine integration with X-API-KEY.

Native Apple Pay

After native initiation, your mobile app receives a short-lived session token for Apple Pay authorization. The app must never hold the merchant X-API-KEY.