Authentication
Madfoa APIs authenticate requests with secret API keys sent as a bearer token. Keys are scoped to an environment — sandbox or live.
API keys
Each environment has its own secret key. Sandbox keys are prefixedsk_sandbox_ and live keys sk_live_. Keep secret keys on the server side only.
Protect your keys
Never expose a secret key in client-side code, mobile apps or public repositories. Treat keys as credentials and rotate them if exposed.
Authorizing a request
Pass the key in the Authorization header as a bearer token on every request.
Authorization header
curl https://sandbox.api.madfoa.com/v1/merchants \
-H "Authorization: Bearer $MADFOA_API_KEY"Environments
- Sandbox —
https://sandbox.api.madfoa.com - Live — provisioned per engagement
Errors
Requests with a missing or invalid key return 401 Unauthorized. Requests to a resource outside the key's scope return 403 Forbidden.
Next: Sandbox →