One bearer key, scoped per environment

Authentication

Every request carries a bearer key. Keys are scoped per tool and per environment, so a sandbox key never reaches production data and a key issued for one tool cannot call another.

Headers

Authorization: Bearer sk_live_… Sidaxis-Version: 2026-09-14 Idempotency-Key: 1f7c9e40-0a2b-4c11-9a6d-2f0b8e5d7c31 Content-Type: application/json

Environments

Prefix Base URL sk_live_ https://api.sidaxis.com/v1 sk_test_ https://sandbox.api.sidaxis.com/v1 The sandbox carries synthetic identities, forced liveness failures and settlement delays, and is never billed.

Versions are dates

Send Sidaxis-Version: 2026-09-14 . A breaking change creates a new date; the previous one stays available for twelve months and returns a deprecation header for the last ninety days of that window. Omit the header and your account default applies — fine in the sandbox, a mistake in production.

Idempotency

Every write accepts Idempotency-Key . Replaying a key returns the original response and never consumes a ceiling twice. Keys are retained for 24 hours. Generate one per logical action, not per retry.

Keys live server-side There is no browser-safe publishable key. The reading happens on the person's device through the SDK and produces a proof; the key that spends that proof stays on your server. See also Quickstart → Errors & refusals →