Authentication

Tsara does not use a single authentication pattern for every endpoint.

Business server-to-server endpoints

Use your business secret key:

Authorization: Bearer sk_live_xxxxx

This applies to the main business API groups:

/v1/payment-links
/v1/transactions
/v1/webhook
/v1/api-keys
/v1/fiat
/v1/payouts
/v1/stablecoin
/v1/customers
/v1/bill
/v1/ramp/widgets
/v1/ramp/transactions

Checkout create

POST /v1/checkout is a public-key flow.

Send the business public key in the body:

{
  "public_key": "pk_live_xxxxx"
}

Checkout server-side reads

The following checkout endpoints use the business secret key:

GET /v1/checkout
GET /v1/checkout/account
GET /v1/checkout/status
POST /v1/checkout/crypto

Ramp widget bootstrap and runtime auth

Ramp widget flows use a different model:

GET /v1/ramp/widgets/bootstrap uses the widget public key
POST /v1/ramp/widgets/session uses the widget public key plus validated origin
runtime quote, options, initiate, and status flows use the returned session_token

Key handling rules

Never expose a business secret key on the frontend
Use public keys only for flows that explicitly require them
Rotate keys if they were ever used in the wrong context