> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowlix.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, test vs. live mode, and keeping your credentials safe

The Flowlix API authenticates every request with a secret API key sent as a
Bearer token:

```bash theme={null}
curl https://api.flowlix.dev/v1/payments \
  -H "Authorization: Bearer api_test_sk_abc123def456"
```

Requests without a valid key return `401 Unauthorized` with
`error.code: "invalid_api_key"`. See [Errors](/guides/errors).

## API keys

You manage API keys in the **Developers** section of the Merchant Portal. Each
key belongs to exactly one merchant account and one mode:

| Prefix         | Mode | Behavior                                                                                         |
| -------------- | ---- | ------------------------------------------------------------------------------------------------ |
| `api_test_sk_` | Test | Payments are simulated end to end. No real cards are charged. Use [test cards](/guides/testing). |
| `api_live_sk_` | Live | Real payments with real funds.                                                                   |

Test and live mode share the same API host — the mode is determined entirely
by the key you send. Objects created in one mode are invisible to keys of the
other mode, and every API object carries a `livemode` boolean so you can always
tell them apart.

## Key security

<Warning>
  Secret keys grant full access to your merchant account: creating payments,
  reading payment data, and issuing refunds. Treat them like passwords.
</Warning>

* Call the API only from your backend. Never expose secret keys in browsers,
  mobile apps, or client-side code.
* Store keys in a secrets manager or environment variables, never in source
  control.
* Rotate keys from the Merchant Portal if you suspect a leak. Revoked keys stop
  working immediately and requests with them return `401`.

## Common authentication errors

| HTTP  | `error.code`      | Meaning                                                                                           | Fix                                                            |
| ----- | ----------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| `401` | `invalid_api_key` | Key missing, malformed, expired, or revoked                                                       | Send `Authorization: Bearer <key>` with a current key          |
| `403` | `mode_mismatch`   | Key is valid but not allowed to perform this operation, or the resource belongs to the other mode | Use the right key for the resource's mode and merchant account |