> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vestrapay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and environments

> Test vs live keys, hosts, and how to authenticate server calls.

Keys live in the merchant dashboard under **Settings → Developers**. Each environment has its own pair.

| Key    | Prefix                  | Use                                      |
| ------ | ----------------------- | ---------------------------------------- |
| Secret | `sk_test_` / `sk_live_` | Initialize and verify, from your server. |
| Public | `pk_test_` / `pk_live_` | Hosted checkout.                         |

## Authenticate

```
x-api-key: sk_test_…
```

`Authorization: Bearer sk_test_…` is accepted as well.

## Hosts

| Environment | Base URL                                  | Keys                   |
| ----------- | ----------------------------------------- | ---------------------- |
| Staging     | `https://server.staging.vestrapay.app/v1` | `sk_test_`, `pk_test_` |
| Production  | `https://api.vestrapay.com/v1`            | `sk_live_`, `pk_live_` |

Checkout is `https://checkout.vestrapay.com/<accessCode>` in production and `https://checkout-staging.vestrapay.app/<accessCode>` in staging. Initialize returns the matching `checkoutUrl`.

Collections, keys, and webhooks are scoped to the environment you authenticated with.

## Checkout sessions

Initialize returns an access code. Follow-up checkout calls send:

```
x-access-code: <accessCode>
```

`access_code` as a query parameter is accepted. Access codes expire after 60 minutes.