Authentication

Send your secret key as a bearer token:

Authorization: Bearer sk_test_AbCdEf123456_<secret>

• Keys are scoped to one merchant and one environment.
• Scopes: checkout_sessions:write, payments:read, refund_requests:write.
• Keys are shown once. Orion stores only a hash.
• Rotate to issue a new key; the old one keeps working for 24 hours. Revoke to disable a key immediately.
• Never put a secret key in browser or mobile code.

A key can only read and act on its own merchant's records. Requests for another merchant's payment return 404 not_found.