Authenticating requests
curl https://api.amnenpay.com/v1/transfers \ -H "Authorization: Bearer sk_test_your_key_here" \ -H "Content-Type: application/json"
Best practices
Keep secrets server-side
Never expose secret keys in client-side code or public repos.
Scope & restrict
Grant only the permissions each key needs and whitelist IPs where possible.
Rotate regularly
Rotate keys periodically and immediately if one is ever exposed.
Separate environments
Use distinct test and live keys so sandbox never touches production.