Authentication and base URL

Every SolvaPay REST API request goes to one base URL and carries a secret API key.

	Value
Base URL	`https://api.solvapay.com`
Path prefix	`/v1/sdk/` (for example `https://api.solvapay.com/v1/sdk/products`)
Auth header	`Authorization: Bearer <secret key>`
Alternative header	`X-API-Key: <secret key>`
Sandbox key prefix	`sk_sandbox_`
Production key prefix	`sk_live_`
Where to get keys	SolvaPay Console > Developers > API Keys
OpenAPI spec	`https://docs.solvapay.com/api-reference/openapi.json`

Get a secret key

Sign in to SolvaPay Console. If you don’t have an account, create one.
Click Developers in the sidebar.
Under API Keys > Sandbox keys, click Generate sandbox key and copy the key.
Store it as an environment variable, for example SOLVAPAY_SECRET_KEY.

Secret keys are server-side credentials. Don’t put them in browser code, mobile apps, or public repositories.

Sandbox and production

Sandbox and production use the same base URL. The key prefix selects the environment:

Key prefix	Environment	Data
`sk_sandbox_`	Sandbox	Test data and test payments only
`sk_live_`	Production	Real customers and real payments

A key only works while your account is in its environment. A new account starts in sandbox, so build and test with a sandbox key. When you go live and switch the account to production in SolvaPay Console, replace the key with a production key. If you switch back to sandbox, switch back to the sandbox key too. A key for the other environment is rejected with 403 (see Authentication errors).

Make your first request

List the products in your account:

curl https://api.solvapay.com/v1/sdk/products \
  -H "Authorization: Bearer $SOLVAPAY_SECRET_KEY"

A 200 response with a JSON body means your key and base URL are correct. A new account can return an empty list. The TypeScript SDK uses the same base URL by default and reads the key from SOLVAPAY_SECRET_KEY.

Authentication errors

Response	Cause
`401` `Invalid authorization header. Use either Authorization: Bearer <key> or X-API-Key: <key>`	No key was sent, or the header is malformed.
`401` `Invalid or expired secret key`	The key was sent but isn’t valid. Check that you copied the whole key and that it hasn’t been revoked.
`403` `key_env_mismatch`	The key is valid but belongs to the other environment. For example, a sandbox key after the account was switched to production. Use the key for the account’s current environment, or switch the account back in SolvaPay Console.

A 403 body names both environments and the key to use:

{
  "code": "key_env_mismatch",
  "message": "This is a sandbox secret key, but your SolvaPay account is in live mode. Use your live secret key (sk_live_...), or switch the account back to sandbox in the SolvaPay Console.",
  "keyEnvironment": "sandbox",
  "providerEnvironment": "live",
  "statusCode": 403
}

Admin MCP Server

The admin MCP Server at https://mcp.solvapay.com/mcp signs you in with OAuth, so you don’t need a key to connect it. OAuth sessions use the environment your account is in. The server also accepts these secret keys as Authorization: Bearer <secret key> for clients that can’t open a browser. The same rule applies there: the key must match the account’s current environment.

Get started

Guides

Managed MCP

Plans and billing

Webhooks

Admin MCP Server

Changelog

Get a secret key

Sandbox and production

Make your first request

Authentication errors

Admin MCP Server

​Get a secret key

​Sandbox and production

​Make your first request

​Authentication errors

​Admin MCP Server

Get a secret key

Sandbox and production

Make your first request

Authentication errors

Admin MCP Server