API keys and environments - Vestrapay

Keys live in the merchant dashboard under Settings → Developers. Each environment has its own pair.

Key	Prefix	Use
Secret	`sk_test_` / `sk_live_`	Initialize and verify, from your server.
Public	`pk_test_` / `pk_live_`	Hosted checkout.

Authenticate

x-api-key: sk_test_…

Authorization: Bearer sk_test_… is accepted as well.

Hosts

Environment	Base URL	Keys
Staging	`https://server.staging.vestrapay.app/v1`	`sk_test_`, `pk_test_`
Production	`https://api.vestrapay.com/v1`	`sk_live_`, `pk_live_`

Checkout is https://checkout.vestrapay.com/<accessCode> in production and https://checkout-staging.vestrapay.app/<accessCode> in staging. Initialize returns the matching checkoutUrl. Collections, keys, and webhooks are scoped to the environment you authenticated with.

Checkout sessions

Initialize returns an access code. Follow-up checkout calls send:

x-access-code: <accessCode>

access_code as a query parameter is accepted. Access codes expire after 60 minutes.

⌘I