> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getflick.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests, and which key to use where.

Every endpoint takes a **secret key** as a bearer token:

```bash theme={null}
curl https://flickopenapi.co/merchant/banks \
  -H "Authorization: Bearer sk-..."
```

## Key types

| Prefix | Name | Where it belongs |
| - | - | - |
| `sk-` | Secret key | Server side only. Authenticates API requests. |
| `pk-` | Public key | Safe to expose. Identifies your account in client-side checkout and in webhook payloads. |

> [!WARNING]
>
> A secret key can move money and read customer identity data. Never ship one in a
> mobile app, browser bundle, or public repository. If one leaks, roll it in the
> dashboard immediately.

## Live and test keys

Each account has a separate live and test key. The base URL is the same for both —
**the key alone decides whether a request is live**. There is no sandbox hostname.

See [Environments](https://docs.getflick.co/guides/environments.md) for what that means in practice.

## Errors

| Status | Meaning |
| - | - |
| `401` | Missing, malformed, or revoked key. |
| `403` | Valid key, but your account lacks that product. Enable it in the dashboard. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.