Authentication
Choose the correct server API or Dashboard session boundary.
BramaPay has two merchant authentication surfaces.
Integration API key
Use the secret project key for server-to-server invoice operations:
X-Api-Key: YOUR_API_KEYOnly sk_live_... keys are accepted by /v1/invoices. The key selects its project. Store it in a server-side secret manager; never expose it in browser code, mobile apps, source control, URLs, or logs.
Dashboard JWT
Project, wallet, key, webhook, billing, treasury, and referral management endpoints use the authenticated Dashboard session: Bearer access token plus an HttpOnly refresh cookie. Project-scoped dashboard requests also send X-Project-Id.
These JWT endpoints support the first-party merchant Dashboard. A standalone commerce backend should normally use the narrow /v1/invoices contract rather than reproducing Dashboard session management.