Authentication

Every request carries a secret key in the Authorization header. The key decides both who you are and which mode you are in.

Key types

Prefix	Where it belongs	What it can do
`pk_test_` `pk_live_`	Browsers, mobile apps	Identifies your account publicly. Cannot create or read payments.
`sk_test_` `sk_live_`	Your server, only	Full access to the API for that mode.

A secret key can create charges against your Fonepay account. Keep it in environment configuration, never in a repository, a mobile binary, or client-side JavaScript. If one leaks, rotate it — rotation mints the replacement first, so your checkout never goes down between the two steps.

Sending the key

Bearer is the normal form:

bash

curl https://qora.laayo.com.np/v1/balance \
  -H "Authorization: Bearer sk_test_YOUR_KEY"

HTTP Basic also works, with the key as the username and an empty password:

bash

curl https://qora.laayo.com.np/v1/balance -u sk_test_YOUR_KEY:

Storage on our side

Secret keys are stored as a SHA-256 hash and nothing else. We cannot show you a secret key again after you create it, and a database dump would not yield a usable one. That is why the dashboard shows a new key exactly once, and why losing one means rotating rather than looking it up.

Failure responses

Status	Code	Cause
`401`	`authentication_required`	No `Authorization` header.
`401`	`invalid_api_key`	Unknown, revoked, or a publishable key used server-side.
`403`	`live_mode_unavailable`	Live key used before business verification is approved.
`403`	`account_suspended`	The account is suspended. Contact support.

Rotating a key

Rotation creates the replacement before revoking the old one, so there is always a working key. Deploy the new value, confirm traffic is flowing, and the old key is already dead — it stops working the moment you rotate.