Authentication

Overview

Every Payment API request is authenticated with an API key, sent as a bearer token:

Authorization: Bearer sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Creating an API key

1. In the dashboard, open a project and go to its API Key tab.
2. Enter a name for the key (for your own reference — e.g. “Production backend”) and click Create API key.
3. Copy the secret shown. It is displayed once — Baiyar only stores its hash, so if you lose it you must revoke it and create a new one.

Caution

Treat an API key like a password. Store it in a server-side secret manager, never in client-side code or a public repository.

What a key is scoped to

An API key is created for one project and one environment (sandbox or production) — it cannot be reused across projects or environments. This means:

• Every request you make with a key is implicitly limited to that key’s own project. If you send a project_id in a request body or query string that doesn’t match, the request is rejected with 404 PROJECT_NOT_FOUND (not 403) — the API deliberately doesn’t reveal whether a different project exists.
• A sandbox key never touches production data, and vice versa.

If you work with multiple projects, create one API key per project.

Error responses

Status	Code	Meaning
401	UNAUTHORIZED	The Authorization header is missing, or the key is invalid or revoked
403	FORBIDDEN	The project exists but isn’t usable right now (inactive, or in production, not yet approved)
404	PROJECT_NOT_FOUND	The project doesn’t exist, or belongs to a different API key

See the API Reference for endpoint-level detail.