Skip to main content

​
Authentication

Payzor has three kinds of actors, and each authenticates differently: All credentials travel in the same header; the prefix tells Payzor who you are.

​
Merchant keys (sk_mch_...)

Issued when a console user registers a business with POST /merchants. Properties:
  • Shown once at creation; only a hash is stored.
  • Scoped to exactly one merchant record: it can never touch another merchant’s money.
  • Rotate by creating a new merchant and migrating (revocation API is on the roadmap).

​
Agent keys (pz_sk_...)

Issued per agent from the console or CLI. Properties:
  • The key is the agent’s identity for money movement; every payment is evaluated against that agent’s policy.
  • An agent can only spend its own balance. There is no way to pass an arbitrary agentId; if the model could choose the wallet, the key would constrain nothing.

​
Console sessions (JWT)

Obtained by logging in through the console (email or Google OAuth). Required for:
  • POST /merchants
  • GET|POST /settings/webhooks, deliveries
  • POST /approvals/:id/grant|reject (human approvals)
  • POST /kyt/screen
  • GET /export/transactions.csv

​
Errors

Missing or invalid credentials return 401 with a JSON body explaining which credential was expected:
A valid credential acting where it doesn’t belong returns 403.
Some deployments allow anonymous access in local dev mode (PAYZOR_REQUIRE_API_KEY=false). Never rely on this outside local testing; production requires keys everywhere.