Skip to main content
Every request is authenticated with your API key credentials, sent as two headers:

API key

Created from your dashboard’s API keys page. Used for server-to-server integrations. Keep both the key and secret secret — never expose them in client-side code.
The API keys page lives in the Developer extension. If you don’t see it, open Extensions in your dashboard and install Developer first.

​
Example

Missing or invalid credentials return 401 Unauthorized (Missing API credentials or Invalid API credentials). A key that authenticates but may not be used — wrong environment, disabled, expired, or calling from a non-allow-listed IP — returns 403 Forbidden.

​
Test vs live keys

Keys come in two environments. Live keys (pk_live_) work against api.hyparrow.cloud and move real money. Test keys (pk_test_) work only against the Sandbox at sandbox.hyparrow.cloud, where every provider is simulated. A key from one environment is rejected by the other with 403 Forbidden, so a test key can never touch production. Create either kind by switching your dashboard between Live and Sandbox mode.