> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payluk.ng/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secret keys, environments, and the customer-id header.

## Secret keys

Every request must include your secret key as a Bearer token:

```bash theme={null}
Authorization: Bearer sk_test_replace_me
```

The key prefix selects the environment:

| Prefix      | Environment | Notes                           |
| ----------- | ----------- | ------------------------------- |
| `sk_test_…` | Test        | For use against **staging**.    |
| `sk_live_…` | Live        | For use against **production**. |

<Warning>
  On **production**, test keys are rejected. On **staging**, only live-style
  behaviour is served. Keep your secret keys server-side; never ship them in
  client apps or commit them to source control.
</Warning>

## The `customer-id` header

Many routes act on behalf of a specific merchant customer (a buyer or seller you
manage). These require a `customer-id` header alongside your secret key:

```bash theme={null}
Authorization: Bearer sk_test_replace_me
customer-id: 665f1b2c9a1e4d0012ab3c01
```

Routes that **require** `customer-id` include wallet, confirm-payment, milestone
confirm, disputes (per-customer), payments, cards, and the crypto whitelist.

<Info>
  A few merchant-wide routes must **not** include a `customer-id` header, namely
  [List all customers' disputes](/api-reference/disputes/list-all-customers-disputes),
  [Get escrow feeds](/api-reference/disputes/get-escrow-feeds), and
  [Resolve dispute & disburse](/api-reference/disputes/resolve-dispute).
  Sending one will scope the request incorrectly.
</Info>

## Merchant super-admin routes

Routes under **Merchant Customers** require the API key to belong to a merchant
super-admin account. A regular customer key cannot create or manage other
customers.

## Common auth errors

| Status | Message                          | Cause                                           |
| ------ | -------------------------------- | ----------------------------------------------- |
| `401`  | `No token provided`              | Missing `Authorization` header.                 |
| `401`  | `Access denied`                  | Key is valid but not permitted for this action. |
| `400`  | `customer-id header is required` | Route needs a `customer-id` header.             |