> ## Documentation Index
> Fetch the complete documentation index at: https://docs.skinloop.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use merchant keys safely from your server.

Merchant API endpoints use `Authorization: Bearer <Skinloop API key>`.
Copy the API URL from your dashboard rather than assuming a public hostname.
Use test keys against the test environment and live keys only after your
integration passes the test-to-live checklist.

Keys are shown once when created. Store them in server-side secret storage,
restrict access, and rotate or revoke a key immediately if it may have leaked.
Issue separate keys for separate services and do not print them in errors.

```http theme={null}
Authorization: Bearer YOUR_SERVER_SIDE_KEY
```

Checkout customer flows use opaque, short-lived capabilities returned by the
checkout flow. Never manufacture, persist in a public page, or substitute a
merchant API key for one.

| Response | Meaning                                                              |
| -------- | -------------------------------------------------------------------- |
| `401`    | Missing, invalid, or revoked credentials                             |
| `403`    | Valid credentials without the required scope, or a disallowed origin |

**Next:** review [API keys and scopes](/api-keys), then create a checkout from
your server.