Get started
Authentication
Authenticate every request with a secret key, and keep that key safe.
Every request carries your secret key as a bearer token in the Authorization header.
Authenticated request
curl https://sandbox.cswitchcba.com/v1/payments \
-H "Authorization: Bearer sk_test_your_key"Sandbox and live keys
| Key | Starts with | Base URL | Money |
|---|---|---|---|
| Sandbox | sk_test_ | https://sandbox.cswitchcba.com/v1 | Fake |
| Live | sk_live_ | https://api.cswitchcba.com/v1 | Real |
Keeping keys safe
- Keep secret keys on your server. Never put them in a mobile app, a web page or a public repository.
- Store them in environment variables, not in code.
- Rotate a key straight away if you think it has leaked. You can create, rotate and revoke keys in the dashboard.
CarefulA live secret key can move real money. Treat it like the password to your merchant account.
API versions
The current version is 2026-10-01. Breaking changes always come with a new version, announced in the changelog.