> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usedemat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate secret key requests with Bearer sk_test_ or sk_live_ keys.

All secret key requests must be authenticated. The key identifies the merchant and the environment (test or live).

Use the **Bearer** scheme:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
Authorization: Bearer sk_test_your_secret_key
```

Requests without a valid secret key return **401 Unauthorized**.

## Key types

| Type | Prefix | Where it is used |
| - | - | - |
| Secret | `sk_test_` / `sk_live_` | Backend calls to this API **and** verifying [webhooks](/guides/webhooks) (`x-demat-signature`). Keep it on the server only. |
| Publishable | `pk_test_` / `pk_live_` | Frontend and checkout. Cannot call secret endpoints. |

Copy your keys from the Demat dashboard after you create a merchant account. Keep the secret key in your server environment. Never put it in a browser or mobile app.

## Test vs live

Use the same base URL for both. The secret key selects the data plane.

| | Test | Live |
| - | - | - |
| Prefix | `sk_test_` / `pk_test_` | `sk_live_` / `pk_live_` |
| Money | Sandbox and dummy providers | Real settlements |
| Access | Test secret key | Live secret key, after admin verification **and** live mode |

A test key always uses sandbox data. A live key requires admin verification **and** live mode.

## Protect the secret key

* Do not put `sk_` keys in frontend code, mobile apps, or git.
* Store them in environment variables or a secrets manager.
* Rotate a key immediately if you think it leaked.

## SSL

Call the API over HTTPS. Do not disable TLS verification (`VERIFY_PEER` or equivalent) in production.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.