Authentication

​

API keys

curl https://api.puffinmoney.com/v1/gateway/api/payment-intents/9b1f... \
  -H "X-API-Key: mk_live_..."

• Keys are shown once at creation and stored hashed (SHA-256).
• Revoke and rotate anytime from the dashboard (DEVELOPER role or above).
• Never use an API key in browser or mobile code — use payment links or the iframe SDK client-side.

​

Rate limits

​

Errors

{ "error": { "code": "invalid_api_key", "message": "Invalid or revoked API key" } }