Authentication

Every request carries a bearer credential:

Authorization: Bearer <key_id>:<secret>

Test keys start with bp_test_, live keys with bp_live_. The secret is shown once at creation and stored only as a hash — if it is lost, rotate the key.

Scopes

Each key carries an explicit scope list, and each endpoint declares the single scope it needs. Calling outside your scopes returns FORBIDDEN_SCOPE; calling a product your business is not approved for returns PRODUCT_NOT_ENABLED.

IP allowlists

Live keys may be restricted to a set of source addresses. A call from anywhere else fails with IP_NOT_ALLOWED before it reaches any business logic.

Request signing

Where signing is enabled, requests carry a timestamped signature header and replays are rejected with REPLAY_DETECTED. Keep client clocks accurate.

Handling failures