> ## Documentation Index
> Fetch the complete documentation index at: https://docs.solvapay.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> SolvaPay quick facts:
> - REST API base URL: https://api.solvapay.com. All public endpoints are under /v1/sdk/ (for example GET https://api.solvapay.com/v1/sdk/products). Sandbox and production share this URL.
> - Auth: send a secret key as `Authorization: Bearer <secret key>` (the REST API also accepts `X-API-Key: <secret key>`).
> - Secret key prefixes: `sk_sandbox_` (sandbox, test payments) and `sk_live_` (production). The prefix selects the environment.
> - Get keys in SolvaPay Console (https://app.solvapay.com) > Developers > API Keys. Use a sandbox key while building.
> - Admin MCP Server: https://mcp.solvapay.com/mcp (Streamable HTTP). Connect with OAuth: add the URL and sign in with the SolvaPay account; no API key needed. OAuth sessions use the live account; for sandbox data or headless clients, send `Authorization: Bearer <secret key>` (X-API-Key is ignored).
> - Install the SolvaPay agent skills: `npx skills add https://solvapay.com` (skills CLI older than 1.5.7: `npx skills add solvapay/skills`).
> - TypeScript SDK setup: `npx solvapay@latest init`. The SDK reads SOLVAPAY_SECRET_KEY and defaults to https://api.solvapay.com.
> - Plans take an options[] array (billingCycle, charge, limit, ...). Retired plan fields price, freeUnits and billingCycle are rejected.
> - Step-by-step from zero to a first paid call: Managed MCP https://docs.solvapay.com/build/managed-mcp.md, TypeScript SDK https://docs.solvapay.com/build/typescript-sdk.md, agent skill https://docs.solvapay.com/build/agent-skill.md.
> - Details: https://docs.solvapay.com/api-reference/authentication.md. OpenAPI spec: https://docs.solvapay.com/api-reference/openapi.json.

# Authentication and base URL

> REST API base URL, the Authorization header, secret key prefixes, and where to get your keys.

Every SolvaPay REST API request goes to one base URL and carries a secret API key.

| | Value |
| - | - |
| **Base URL** | `https://api.solvapay.com` |
| **Path prefix** | `/v1/sdk/` (for example `https://api.solvapay.com/v1/sdk/products`) |
| **Auth header** | `Authorization: Bearer <secret key>` |
| **Alternative header** | `X-API-Key: <secret key>` |
| **Sandbox key prefix** | `sk_sandbox_` |
| **Production key prefix** | `sk_live_` |
| **Where to get keys** | [SolvaPay Console](https://app.solvapay.com) > **Developers** > **API Keys** |
| **OpenAPI spec** | [`https://docs.solvapay.com/api-reference/openapi.json`](https://docs.solvapay.com/api-reference/openapi.json) |

## Get a secret key

1. Sign in to [SolvaPay Console](https://app.solvapay.com). If you don't have an account, [create one](/get-started/create-account).
2. Click **Developers** in the sidebar.
3. Under **API Keys** > **Sandbox keys**, click **Generate sandbox key** and copy the key.
4. Store it as an environment variable, for example `SOLVAPAY_SECRET_KEY`.

Secret keys are server-side credentials. Don't put them in browser code, mobile apps, or public repositories.

## Sandbox and production

Sandbox and production use the same base URL. The key prefix selects the environment:

| Key prefix | Environment | Data |
| - | - | - |
| `sk_sandbox_` | Sandbox | Test data and test payments only |
| `sk_live_` | Production | Real customers and real payments |

A key only works while your account is in its environment. A new account starts in sandbox, so build and test with a sandbox key. When you [go live](/get-started/go-live) and switch the account to production in SolvaPay Console, replace the key with a production key. If you switch back to sandbox, switch back to the sandbox key too. A key for the other environment is rejected with `403` (see [Authentication errors](#authentication-errors)).

## Make your first request

List the products in your account:

```bash theme={null}
curl https://api.solvapay.com/v1/sdk/products \
  -H "Authorization: Bearer $SOLVAPAY_SECRET_KEY"
```

A `200` response with a JSON body means your key and base URL are correct. A new account can return an empty list.

The [TypeScript SDK](/sdks/typescript/intro) uses the same base URL by default and reads the key from `SOLVAPAY_SECRET_KEY`.

## Authentication errors

| Response | Cause |
| - | - |
| `401` `Invalid authorization header. Use either Authorization: Bearer <key> or X-API-Key: <key>` | No key was sent, or the header is malformed. |
| `401` `Invalid or expired secret key` | The key was sent but isn't valid. Check that you copied the whole key and that it hasn't been revoked. |
| `403` `key_env_mismatch` | The key is valid but belongs to the other environment. For example, a sandbox key after the account was switched to production. Use the key for the account's current environment, or switch the account back in SolvaPay Console. |

A `403` body names both environments and the key to use:

```json theme={null}
{
  "code": "key_env_mismatch",
  "message": "This is a sandbox secret key, but your SolvaPay account is in live mode. Use your live secret key (sk_live_...), or switch the account back to sandbox in the SolvaPay Console.",
  "keyEnvironment": "sandbox",
  "providerEnvironment": "live",
  "statusCode": 403
}
```

## Admin MCP Server

The [admin MCP Server](/mcp-server/installation) at `https://mcp.solvapay.com/mcp` signs you in with OAuth, so you don't need a key to connect it. OAuth sessions use the environment your account is in. The server also accepts these secret keys as `Authorization: Bearer <secret key>` for clients that can't open a browser. The same rule applies there: the key must match the account's current environment.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.