> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cwmpay.in/llms.txt
> Use this file to discover all available pages before exploring further.

# CWM Pay Authentication: API Keys and Best Practices

> CWM Pay authenticates every request with a secret API key. Learn how to find your keys, pass them correctly, and keep them secure in your application.

CWM Pay authenticates every API request using your secret API key. Include your key in the `Authorization` header of each request as a Bearer token — there are no sessions, no cookies, and no OAuth flows to manage. If the key is missing or invalid, the API immediately returns a `401 Unauthorized` error.

## Your API keys

CWM Pay gives you two types of keys, each with a distinct purpose:

| Key type            | Prefix        | When to use                                                                               |
| ------------------- | ------------- | ----------------------------------------------------------------------------------------- |
| **Test secret key** | `sk_test_...` | Development, CI/CD, and integration testing. Payments are simulated; no real money moves. |
| **Live secret key** | `sk_live_...` | Production environments only. Charges are real.                                           |

Find both keys in the dashboard under **Settings → API Keys**. When you create a new key, copy it immediately — for security reasons, the dashboard will never display the full key value again. If you lose a key, rotate it to generate a new one and revoke the old one.

## Making authenticated requests

Pass your secret key in the `Authorization` header using the `Bearer` scheme on every request.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.cwmpay.com/v1/payments \
    -H "Authorization: Bearer sk_test_your_key_here" \
    -H "Content-Type: application/json"
  ```

  ```javascript JavaScript (fetch) theme={null}
  const response = await fetch("https://api.cwmpay.com/v1/payments", {
    method: "GET",
    headers: {
      "Authorization": "Bearer sk_test_your_key_here",
      "Content-Type": "application/json",
    },
  });

  const data = await response.json();
  ```

  ```python Python (requests) theme={null}
  import requests

  response = requests.get(
      "https://api.cwmpay.com/v1/payments",
      headers={
          "Authorization": "Bearer sk_test_your_key_here",
          "Content-Type": "application/json",
      },
  )

  data = response.json()
  ```
</CodeGroup>

## Keeping your keys secure

<Warning>
  **Never expose your secret key in client-side code, version control, or public repositories.** Anyone who obtains your live secret key can make real charges on your account. If you accidentally commit a key, rotate it immediately from **Settings → API Keys** and treat it as fully compromised.
</Warning>

Store your API keys in environment variables, not hardcoded in your source files. Create a `.env` file at the root of your project and load it at runtime:

```bash .env theme={null}
CWM_SECRET_KEY=sk_test_your_key_here
```

Then reference it in your application code:

<CodeGroup>
  ```javascript Node.js theme={null}
  // Load with a package like dotenv
  const apiKey = process.env.CWM_SECRET_KEY;
  ```

  ```python Python theme={null}
  import os

  api_key = os.environ["CWM_SECRET_KEY"]
  ```
</CodeGroup>

Add `.env` to your `.gitignore` so it's never committed to version control:

```bash .gitignore theme={null}
.env
.env.local
.env.*.local
```

## Authentication errors

If your request is missing an API key or includes an invalid one, CWM Pay returns the following error:

```json 401 Unauthorized theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "No valid API key provided. Include your secret key in the Authorization header as a Bearer token.",
    "docs_url": "https://docs.cwmpay.com/authentication"
  }
}
```

**To resolve a `401` error:**

1. Confirm the `Authorization` header is present and formatted correctly: `Authorization: Bearer sk_test_your_key_here`.
2. Check that you're using the right key type for your environment — a test key (`sk_test_...`) won't work against production resources that require a live key, and vice versa.
3. Verify the key hasn't been rotated or revoked under **Settings → API Keys**.

## Best practices

* **Rotate keys immediately** if you suspect a key has been compromised. Rotating generates a new key and permanently invalidates the old one.
* **Use separate keys for test and production.** Never use your live key in development or CI/CD pipelines.
* **Restrict key usage by IP address** where possible. The dashboard lets you associate a key with an allowlist of IP addresses so it can only be used from your servers.
* **Audit key usage regularly.** The dashboard logs every API request against the key that authenticated it, making it easy to spot unexpected activity.
* **Inject keys at deploy time.** Use your hosting provider's secrets manager (e.g., AWS Secrets Manager, Vercel Environment Variables, Doppler) rather than shipping keys inside your build artifacts.