## How it works

Authenticate server requests using your secret key in the api-key header. A publishable key is for customer-side checkout steps and must be paired with that payment's client secret.

## Implementation

Create a key under the shop's API Keys & Integration tab and store it in your environment or secrets manager. Use different keys for separate integrations. During rotation, create and deploy the replacement before revoking the old key. Shop-scoped keys act on one shop; account-wide integrations must select the intended shop. Never include secret keys in public JavaScript, URLs or support screenshots.

## In this area

- Secret keys

## Request header

```bash
curl https://api.spicepay.net/payments/PAYMENT_ID \
  -H "api-key: $SPICEPAY_API_KEY"
```

## Related guides

- [API reference](/docs/payment-api/reference/)
- [SDKs](/docs/sdks/overview/)