Authentication
API keys, scopes, and the things a key deliberately cannot do.
Send your key as a bearer token:
curl https://sandbox.inversepay.app/api/b/v1/charges \
-H "Authorization: Bearer $INVERSEPAY_TEST_KEY"Two kinds of credential
A dashboard session is a person acting in a role. An API key is your business's own authority, narrowed to a set of scopes.
They are not the same thing, and we do not pretend otherwise. A key has no seat on your team, so anything that needs a person accountable for it is closed to keys entirely — however the key is scoped.
Scopes
| Scope | Grants |
|---|---|
payments:read | read charges, payment links, invoices, refunds, virtual accounts |
payments:write | create charges |
payouts:read | read payouts, batches and schedules |
balances:read | statements and FX rates |
webhooks:manage | manage endpoints and read deliveries |
A missing scope is a 403 that names the scope you need.
What a key can never do
Not "is not scoped for" — cannot, at all:
- invite or manage members, or change roles
- create, revoke or regenerate another API key
- create, cancel or approve a payout
- issue a refund, or execute an FX conversion
- submit KYB documents or change business settings
Two reasons. Governance is a person's act and needs a person accountable for it. And a key that can mint keys cannot be contained by revoking it — the first thing anybody who steals one does is issue another.
Payouts read through a key; they are raised in the dashboard.
Rotation
Regenerating a key returns a new secret and keeps the old one working for an overlap window, so you can deploy the new secret without a synchronised restart. Revoke the old one when your last instance has it.