Authentication#
The gateway API authenticates with an entity API key, sent as a bearer token.
curl https://manage.casapay.com/api/v1/gateway/agreements \
-H 'Authorization: Bearer sk_live_...'Key format#
| Prefix | Environment | Sessions created |
|---|---|---|
sk_live_ | Live | Real payments via EveryPay |
sk_test_ | Sandbox | Simulator payments, no money moves |
The key prefix - not the base URL - determines whether a session runs in live or test mode. A sk_test_ key always produces a test-mode session.
Keep keys server-side
API keys grant full access to create agreements and collect payments for your entity. Never expose one in browser or mobile code. The tenant-facing checkout is authenticated by the session ID instead.
Errors#
| Status | Code | Cause |
|---|---|---|
| 401 | MISSING_API_KEY | No Authorization header. |
| 401 | INVALID_KEY_FORMAT | Key does not start with sk_live_ or sk_test_. |
| 401 | INVALID_API_KEY | Key not recognised or revoked. |
| 403 | GATEWAY_NOT_ENABLED | Gateway is not enabled for the entity. Contact support. |
{
"error": "Invalid API key.",
"code": "INVALID_API_KEY"
}Rate limits#
| Surface | Limit |
|---|---|
| Authenticated gateway API | 60 requests/minute |
| Public checkout API | 30 requests/minute |
Exceeding a limit returns 429 Too Many Requests.
Entity scoping#
Every key is bound to one entity. Sessions, agreements and invoices are always looked up within that entity, so a request for another entity's session returns 404 SESSION_NOT_FOUND rather than 403 - existence is never leaked across tenants.