API reference

Authentication

Authenticate every request with a secret key in the Authorization header, as a bearer token.

curl https://sandbox.api.saphra.one/v1/checkout/sessions \
  -H "Authorization: Bearer sk_test_…"

Secret keys

Prefix	Environment	Moves real money
`sk_live_`	Live	Yes
`sk_test_`	Sandbox	No

Create and revoke keys in the console. Only the business owner and admins can manage keys.
A key is shown once when it is created. Store it straight away.
Live keys can be created only once your business is verified.
Revoking is immediate; requests with a revoked key fail with api_key_invalid.

HTTP	code	Why
401	`api_key_missing`	No Authorization: Bearer header.
401	`api_key_invalid`	The key is malformed, unknown or revoked.
401	`api_key_wrong_mode`	A test key on the live API, or a live key on the sandbox.
403	`account_not_business`	The key's account is no longer a Business account.
403	`business_not_verified`	A live key whose business is no longer verified.