# Authentication


> Authenticate API requests with a Chiwa Pay secret key.

Canonical: https://docs.chiwapay.com/authentication

Use a secret key on every API request.

## Header

```http
Authorization: Bearer sk_xxx
```

> **Keep your API key secret**
> Do not send a secret key from a browser or mobile app.

## Requirements

| Requirement | Status |
| --- | --- |
| Merchant | `approved` |
| Payment method | `active` |
| Secret key | Not revoked |

## Security

| Area | Description |
| --- | --- |
| Storage | Store it on your server. |
| Logging | Mask secret key values. |
| Rotation | Revoke the old key after the new key is active. |
| IP allowlist | Restrict a key to server IPs or CIDR ranges such as `203.0.113.10` or `203.0.113.0/24`. |

## Example

```tsx
<ApiExample method="GET" path="/payments/f2b1d5b0-7b1f-4c5d-9c37-93f0c8f6a001" />
```