Safe to embed in client apps. Used by the SDKs to fetch offerings and start purchases. Cannot read customer data or perform privileged operations.
Authentication
How CashSDK authenticates every request: the publishable and secret key types, what each one is allowed to do, and where to manage them.
CashSDK authenticates every request with a bearer token in the Authorization
header.
bash
Authorization: Bearer csk_sk_...
Token types#
Publishable keycsk_pk_…Secret keycsk_sk_…Full server-side access. Used by your backend and the CLI. Never ship a secret key in a client app.
MCP tokencsk_mcp_…The durable credential for the MCP server, and what you paste into Claude Code, Cursor or Codex. Workspace-scoped (or narrowed to one app), does not expire, and revocable from Settings → MCP. It can never do more than the member who created it, and billing, membership, SSO, store credentials and workspace deletion are refused outright.
Setup tokencsk_st_…A scoped, short-lived token for onboarding and provisioning flows, handed out in the dashboard's integration prompt. One app, setup routes only, 24-hour expiry, and minting a new one revokes the last, so use an MCP token for anything that lives in a config file.
Treat secret keys like passwords. If one leaks, rotate it immediately from
Settings → API keys or with cashsdk /
the rotate_api_key MCP tool.
Sandbox vs. Production#
There is no separate test key. One app has one publishable key, and it serves both environments. The store decides which one a purchase belongs to. A build run from Xcode or TestFlight transacts against Apple's sandbox; the same build shipped from the App Store transacts against production. CashSDK reads the environment out of the store's own signed payload, so it cannot be spoofed by a client.
Entitlements are resolved and cached per environment, so a Sandbox purchase
never grants Production access to the same user. The SDK learns the environment
from the first verified transaction and sends it as X-CashSDK-Environment;
until then it falls back to the app's default environment, which you can set in
App settings → Default environment (it also controls which environment the
dashboard shows first).
See Testing.
Base URLs#
bash
https://api.cashsdk.com
bash
https://mcp.cashsdk.com/mcp
All endpoints are versioned under /v1. The MCP hostname is the same service,
see the MCP server.
Example request#
bash
curl https://api.cashsdk.com/v1/apps \
-H "Authorization: Bearer csk_sk_..."
A missing or invalid token returns 401 Unauthorized. See
Errors for the full list.