Getting started
Authentication
Bearer keys with scopes, shown once, rotatable, revocable.
Authenticate with a secret key in the Authorization header. Sandbox keys (gp_sk_sandbox_…) only work against the sandbox base URL, and production keys (gp_sk_live_…) only against production — a mismatch fails with401 environment_mismatch.
Scopes
| Field | Type | Description |
|---|---|---|
| read | scope | Balances, transactions, customers, accounts, statements. |
| accounts:create | scope | Create customers and request virtual accounts. |
| payouts:create | scope | Initiate payouts and FX conversions. |
Calls outside a key’s scopes fail with403 missing_scopeand the scope named in the error. Restrict production keys to the narrowest scopes the service needs.
Key lifecycle
Secrets are displayed once at creation. Rotation invalidates the old secret immediately; revocation is permanent. Both are audit-logged with the actor and timestamp. Optional IP allowlists reject requests from unknown addresses before authentication is attempted.