Authentication
Bearer secret keys, environments, and IP allowlists.
Authentication
Send your secret key as a Bearer token on every request:
Authorization: Bearer sk_live_xxxxxxxxxxxxxYour company and the accounts the key may access are resolved from the key. Never send a company identifier in a header — it is ignored.
Key prefixes
| Prefix | Environment |
|---|---|
sk_live_ | Production (live gateway for this docs deploy) |
sk_test_ | Sandbox (sandbox gateway for this docs deploy) |
Current bases: live https://stggateway.momen.co/v1, sandbox https://stggateway-sandbox.momen.co/v1.
The key prefix selects the environment. Each key only works on its own base URL. A sandbox key on production (or the reverse) returns 401 with api_key_wrong_environment.
Shown once
Secret keys are shown once, when created. Momen stores only a hash and a short preview and cannot recover a lost key. Create a new one instead.
IP allowlist (live only)
If you register one or more IP addresses under Settings → Developer, production requests must originate from one of them. Other addresses are rejected with 403 (ip_not_allowed).
With no addresses registered, requests are accepted from any address — registering your servers' addresses is strongly recommended.
Sandbox does not check IPs.
Public keys
Public keys (pk_) are not accepted by any endpoint yet (public_key_not_accepted).