> ## Documentation Index
> Fetch the complete documentation index at: https://docs-v2.reeple.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How to authenticate requests to the Reeple Checkout API

The Checkout API is hosted at:

```
https://api-v4.reeple.ai
```

Every endpoint lives under `/charge`. Authentication is a single header on every request:

```
api-key: YOUR_KEY
```

Which key goes in that header depends on the endpoint.

## Your three credentials

| Credential             | What it does                                                                | Where it lives                                          |
| ---------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------- |
| **Public key**         | Authenticates checkout operations — creating and paying orders              | Server, and safe to expose to your frontend if you must |
| **Secret key**         | Authenticates money-moving and read-back operations — verification, refunds | **Server only**                                         |
| **RSA encryption key** | Encrypts request payloads. Not an API key.                                  | Server                                                  |

<Note>
  Reeple doesn't currently offer self-service key generation. To get your keys, contact Reeple
  as part of onboarding.
</Note>

Keys are issued as a matching set per environment. A test public key only works alongside the
test secret key and the test encryption key — don't mix a test credential with a live one.

## Which key for which endpoint

<Tabs>
  <Tab title="Public key">
    | Endpoint                         |                                                            |
    | -------------------------------- | ---------------------------------------------------------- |
    | `POST /charge/order/create`      | [Create an order](/api-reference/orders/create-order)      |
    | `POST /charge/order/pay`         | [Pay an order](/api-reference/orders/pay-order)            |
    | `POST /charge/order/status`      | [Get order status](/api-reference/orders/get-order-status) |
    | `POST /charge/order/fee`         | [Get order fee](/api-reference/orders/get-order-fee)       |
    | `PATCH /charge/order/save-card`  | [Save a card](/api-reference/orders/save-card)             |
    | `POST /charge/order/event/track` | [Track an event](/api-reference/orders/track-event)        |
    | `GET /charge/banks`              | [List banks](/api-reference/banks/list-banks)              |
    | `GET /charge/ping`               | [Ping](/api-reference/utility/ping)                        |
  </Tab>

  <Tab title="Secret key">
    | Endpoint                                |                                                               |
    | --------------------------------------- | ------------------------------------------------------------- |
    | `POST /charge/order/verify`             | [Verify an order](/api-reference/verification/verify-order)   |
    | `POST /charge/order/refund`             | [Create a refund](/api-reference/refunds/create-refund)       |
    | `GET /charge/order/refunds/all`         | [List refunds](/api-reference/refunds/list-refunds)           |
    | `GET /charge/order/chargebacks/all`     | [List chargebacks](/api-reference/refunds/list-chargebacks)   |
    | `POST /charge/order/card/tokenized/pay` | [Tokenized charge](/api-reference/tokenized/tokenized-charge) |
  </Tab>
</Tabs>

<Warning>
  Sending the wrong kind of key returns `401 — Invalid public key passed` or
  `401 — Invalid SECRET key`. It is not a generic auth failure: the API is telling you the key
  is valid but of the wrong type for that endpoint.
</Warning>

## Authenticating a request

```bash theme={null}
curl -X POST https://api-v4.reeple.ai/charge/order/create \
  -H "Content-Type: application/json" \
  -H "api-key: YOUR_PUBLIC_KEY" \
  -d '{ "data": "YOUR_ENCRYPTED_PAYLOAD" }'
```

<Warning>
  Your secret key can move and read back money. Keep it server-side only — never in client-side
  code, mobile apps, or public repositories. Always call this API over HTTPS.
</Warning>

If you suspect a key has been compromised, contact Reeple immediately to have it rotated. Once
rotated, the old key stops working right away, so update your servers before requesting a
rotation.

## Encryption is separate

Authenticating a request and encrypting its body are two different things. Most endpoints need
both — the `api-key` header **and** an RSA-encrypted `data` field.

<Card title="Encryption" icon="lock" href="/encryption">
  How to encrypt payloads, with working code in four languages.
</Card>

## Next steps

<CardGroup cols={2}>
  <Card title="Status codes" href="/api-reference/statuses">
    Every `statusCode` and `statusId` the API returns.
  </Card>

  <Card title="Errors" href="/api-reference/errors">
    Common error shapes and what causes them.
  </Card>
</CardGroup>