Skip to main content
Merchant API endpoints use Authorization: Bearer <Skinloop API key>. Copy the API URL from your dashboard rather than assuming a public hostname. Use test keys against the test environment and live keys only after your integration passes the test-to-live checklist. Keys are shown once when created. Store them in server-side secret storage, restrict access, and rotate or revoke a key immediately if it may have leaked. Issue separate keys for separate services and do not print them in errors.
Checkout customer flows use opaque, short-lived capabilities returned by the checkout flow. Never manufacture, persist in a public page, or substitute a merchant API key for one. Next: review API keys and scopes, then create a checkout from your server.