CWM Pay Authentication: API Keys and Best Practices

CWM Pay authenticates every request with a secret API key. Learn how to find your keys, pass them correctly, and keep them secure in your application.

CWM Pay authenticates every API request using your secret API key. Include your key in the Authorization header of each request as a Bearer token — there are no sessions, no cookies, and no OAuth flows to manage. If the key is missing or invalid, the API immediately returns a 401 Unauthorized error.

Your API keys

CWM Pay gives you two types of keys, each with a distinct purpose:

Key type	Prefix	When to use
Test secret key	sk_test_...	Development, CI/CD, and integration testing. Payments are simulated; no real money moves.
Live secret key	sk_live_...	Production environments only. Charges are real.

Find both keys in the dashboard under Settings → API Keys. When you create a new key, copy it immediately — for security reasons, the dashboard will never display the full key value again. If you lose a key, rotate it to generate a new one and revoke the old one.

Making authenticated requests

Pass your secret key in the Authorization header using the Bearer scheme on every request.

cURL

curl https://api.cwmpay.com/v1/payments \
  -H "Authorization: Bearer sk_test_your_key_here" \
  -H "Content-Type: application/json"

Keeping your keys secure

Never expose your secret key in client-side code, version control, or public repositories. Anyone who obtains your live secret key can make real charges on your account. If you accidentally commit a key, rotate it immediately from Settings → API Keys and treat it as fully compromised.

Store your API keys in environment variables, not hardcoded in your source files. Create a .env file at the root of your project and load it at runtime:

.env

CWM_SECRET_KEY=sk_test_your_key_here

Then reference it in your application code:

Node.js

// Load with a package like dotenv
const apiKey = process.env.CWM_SECRET_KEY;

Add .env to your .gitignore so it’s never committed to version control:

.gitignore

.env
.env.local
.env.*.local

Authentication errors

If your request is missing an API key or includes an invalid one, CWM Pay returns the following error:

401 Unauthorized

{
  "error": {
    "code": "unauthorized",
    "message": "No valid API key provided. Include your secret key in the Authorization header as a Bearer token.",
    "docs_url": "https://docs.cwmpay.com/authentication"
  }
}

To resolve a 401 error:

1. Confirm the Authorization header is present and formatted correctly: Authorization: Bearer sk_test_your_key_here.
2. Check that you’re using the right key type for your environment — a test key (sk_test_...) won’t work against production resources that require a live key, and vice versa.
3. Verify the key hasn’t been rotated or revoked under Settings → API Keys.

Best practices

• Rotate keys immediately if you suspect a key has been compromised. Rotating generates a new key and permanently invalidates the old one.
• Use separate keys for test and production. Never use your live key in development or CI/CD pipelines.
• Restrict key usage by IP address where possible. The dashboard lets you associate a key with an allowlist of IP addresses so it can only be used from your servers.
• Audit key usage regularly. The dashboard logs every API request against the key that authenticated it, making it easy to spot unexpected activity.
• Inject keys at deploy time. Use your hosting provider’s secrets manager (e.g., AWS Secrets Manager, Vercel Environment Variables, Doppler) rather than shipping keys inside your build artifacts.