Authentication
The Payve API uses Bearer token authentication. Every request must include your API key in the Authorization header.
Authorization: Bearer sk_live_••••••••••••••••Getting your API keys
API keys are found in the Developer section of your merchant dashboard. You will have two keys:
| Key | Prefix | Use |
|---|---|---|
| Live secret key | sk_live_ | Production traffic |
| Sandbox secret key | sk_sand_ | Testing and integration |
Keep keys secret
Sandbox vs live mode
Each merchant account has two independent environments. The API key prefix determines which environment a request targets — there is no separate URL.
# Sandbox request
curl https://api.payve.io/v1/payins \
-H "Authorization: Bearer sk_sand_abc123..." \
-H "Content-Type: application/json"
# Live request
curl https://api.payve.io/v1/payins \
-H "Authorization: Bearer sk_live_abc123..." \
-H "Content-Type: application/json"Sandbox payins, payouts, and conversions never move real money. Use the test credentials page to trigger specific scenarios.
Rotating API keys
- Go to Dashboard → Developer → API Keys
- Click Rotate key next to the key you want to replace
- Copy the new key — it is only shown once
- Update your integration before the old key is invalidated (30-minute grace period)
Rate limits
| Tier | Limit |
|---|---|
| Default | 120 requests / minute |
| Burst | 20 requests / second |
If you exceed the rate limit you will receive a 429 Too Many Requests response. Back off exponentially and retry.
IP allowlisting
For additional security you can restrict your live API key to specific IP addresses from the dashboard. Requests from non-allowlisted IPs will receive 403 Forbidden.