# Authentication

Send your secret key as a bearer token on every request:

```bash
curl https://api.kibanda.africa/v1/shop -H "Authorization: Bearer kb_live_..."
```

- **One key = one shop.** Everything you read or write is scoped to the shop that made the key.
- **Test and live are separate.** `kb_test_…` keys only work on `api-staging.kibanda.africa`; `kb_live_…` keys only on `api.kibanda.africa`. Using one on the other returns `api_key_wrong_environment`.
- **Shown once.** We store only a hash. If you lose a key, create a new one and revoke the old one.
- **Create and revoke keys in the dashboard** (Developers → API keys). An API key can't create or list keys.
- **Server-side only.** Never put a secret key in a browser, mobile app, or a WhatsApp message. If one leaks, revoke it at once; requests with a revoked key fail immediately.

## Errors

| Status | Code | Meaning |
|---|---|---|
| 401 | `unauthenticated` | No `Authorization` header. |
| 401 | `api_key_invalid` | Malformed, unknown or revoked key. |
| 401 | `api_key_wrong_environment` | A test key on production, or a live key on staging. |
| 403 | `session_required` | The endpoint is dashboard-only (API key management). |