API key authentication

What to expect

The developer console supports app records, scoped API keys, and webhook registration. Registration does not mean webhook delivery is enabled. No isolated sandbox, published quota system, or generic /api/v1 API is documented here. Keep secret credentials on trusted servers.

Protected developer requests accept a bearer key. This guide covers 3 practical actions, in the order they usually happen.

Do this first

Read the secret from a server-side environment variable..

Send it in the Authorization header..

Then finish with

Keep request logs from recording that header..

Good to know

Everything here reflects the current Merchant Bridge interface. Labels and buttons may move as the product evolves, but the flow stays the same: prepare, act on the page this guide references, and confirm the result before moving on.

When something does not match what you see, the destination page for this guide is the source of truth.