Authentication

Every request carries a bearer credential in the Authorization header:

Authorization: Bearer uzp_live_…

There are two kinds of credentials.

Secret keys

Format	uzp_test_… (test mode) or uzp_live_… (live mode)
Where to get one	Dashboard → Developers → API keys
Use it from	Your server only
Can call	Every endpoint

The key decides the mode: a test key only sees test payments, a live key only live ones. Creating a live key asks for a confirmation code sent to your email and your PIN.

Caution

Never put a secret key in a browser, a mobile app or a public repository. Anyone holding it can create and cancel payments on your account. If a key leaks, revoke it in the dashboard and create a new one.

Checkout tokens

Each payment comes with its own checkout_token (cs_…). It is scoped to that one payment and is safe to hand to a browser. It can call:

Endpoint	What it returns
GET /v1/payments/{id}	The payer view of the payment: amount, status, description, deposit addresses. No metadata, no settlement details.
GET /v1/payments/{id}/methods	The methods offered on your hosted page (your accepted tokens).
POST /v1/payments/{id}/address	A deposit address for a token and network.

The hosted payment page uses exactly these endpoints, so you can build your own payment page with them (see Headless payments). These endpoints allow requests from any origin (CORS). A checkout token used on a different payment returns 404.

checkout_url carries the token in its fragment (#cs_…), which browsers never send to servers or in Referer headers.

Failed authentication

Status	Code	When
401	unauthorized	Missing, malformed, revoked or unknown credential
403	forbidden	The account is suspended