Skip to contentAuthentication
Merchant integration authentication uses API keys issued by the merchant API-key service.
Credential format
Send the complete credential in the Authorization header as Authorization: Bearer <api-key>. The implemented key format is exzix_test_<24 lowercase hex characters>_<43 URL-safe base64 characters> or the equivalent exzix_live_ form. Use placeholders in documentation and code.
Authorization: Bearer YOUR_TEST_API_KEYMerchant and environment binding
The key is associated with one merchant, one environment (test or live), and a set of validated scopes. The requested merchant path must match the key’s merchant. A Test key cannot access Live operations; the environment cannot be changed by request input.
Scopes
payment_intents:read reads Payment Intents; payment_intents:write creates or cancels them; webhooks:read reads webhook resources; webhooks:write manages webhook operations; merchant:readiness reads go-live readiness.
Failure behavior
Missing, malformed, unknown, revoked, or unverifiable credentials produce 401 unauthenticated. A valid credential lacking a required scope produces 403 insufficient_scope. A valid key used for another merchant produces 403 forbidden; an environment mismatch produces 403 environment_mismatch.
Credential handling
The complete key is returned only at creation and is not recoverable from the stored verifier. Never place credentials in URLs, browser JavaScript, logs, or webhook payloads.