Authentication

Authenticate raw API requests with a secret key in the Authorization header: the bearer token format and which key type each call requires.

Every request to the CashSDK API must include a bearer token in the Authorization header. Server-side calls use a secret key.

bash

Authorization: Bearer csk_sk_...

This page covers authenticating raw API requests. For a broader overview of keys, rotation, and the dashboard, see Authentication.

Key types#

Key	Prefix	Where it's used	Access
Secret key	`csk_sk_…`	Your backend, CLI, MCP server	Full server-side access
Publishable key	`csk_pk_…`	Client SDKs	Fetch offerings, start purchases
Setup token	`csk_st_…`	Onboarding & provisioning	Scoped, short-lived setup tasks

Never embed a secret key in a mobile or web client. Client apps authenticate with a publishable key only. If a secret key leaks, rotate it immediately from Settings → API keys.

Sandbox vs. Production#

There is no separate test key. An app has one publishable key and one secret key, and both serve either environment. The store decides which one a purchase belongs to (a build run from Xcode or TestFlight transacts against Apple's sandbox). CashSDK reads the environment from the store's own signed payload, so a client cannot spoof it, and entitlements are resolved per environment so a Sandbox purchase never grants Production access.

Device calls may send X-CashSDK-Environment to pin reads before the first verified transaction; otherwise the app's default environment applies. See Testing.

Example request#

bash

curl https://api.cashsdk.com/v1/apps \
  -H "Authorization: Bearer csk_sk_..."

json

{
  "data": [
    {
      "id": "app_2mK4pQ",
      "name": "Focus Timer",
      "platform": "ios",
      "bundle_id": "com.example.focustimer",
      "created_at": "2026-05-02T09:14:00Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Failed authentication#

A missing, malformed, or revoked token returns 401 Unauthorized:

json

{
  "error": {
    "code": "unauthorized",
    "message": "No valid API key was provided."
  }
}

Using a key without permission for a resource returns 403 Forbidden. See Errors for the complete list.

Next steps#

Errors

Status codes, error bodies, and rate limits.

Apps

Your first authenticated call.