Send your secret key as a bearer token. Keys starting sk_test_ only touch sandbox data.
curl https://api.payloop.example/v1/me \
-H "Authorization: Bearer sk_test_4f9a…"100 requests per second per key. We return 429 with a Retry-After header when you go over.
HTTP/1.1 429 Too Many Requests
Retry-After: 2Compare the Payloop-Signature header with an HMAC of the raw body using your webhook secret.
const sig = hmac("sha256", secret, rawBody)
if (!safeEqual(sig, header)) return 400Yes. Add an Idempotency-Key header and we'll return the first result for 24 hours instead of charging twice.
curl -X POST …/v1/charges \
-H "Idempotency-Key: order_1042"