API keys

Widgets use a public key in the browser. Server calls use a secret key.

Each platform has test keys (pk_test_ / sk_test_) and, after activation, live keys (pk_live_ / sk_live_).

From your server: Authorization: Bearer sk_test_… or sk_live_…. Base URL: https://api.payloqa.com.

Dashboard cookies are not API credentials — do not send them on API requests.