> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paygood.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Authenticate Your PayGood API Requests

> Pass your PayGood API key as a Bearer token in the Authorization header to authenticate every request. Includes curl, JavaScript, and Python examples.

Every request you make to the PayGood API must include your API key as a Bearer token in the `Authorization` header. PayGood rejects any request that is missing this header or that presents an invalid key.

## Authorization header format

Include the following header in every API request, replacing the placeholder with your actual key:

```text theme={null}
Authorization: Bearer $PAYGOOD_API_KEY
```

## Authenticated request examples

The examples below show how to make an authenticated `GET /payments` request across common HTTP clients.

<CodeGroup>
  ```bash curl theme={null}
  curl https://api.paygood.co/payments?merchantId=mer_01example \
    -H "Authorization: Bearer $PAYGOOD_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    "https://api.paygood.co/payments?merchantId=mer_01example",
    {
      method: "GET",
      headers: {
        Authorization: `Bearer ${process.env.PAYGOOD_API_KEY}`,
      },
    }
  );

  const data = await response.json();
  console.log(data);
  ```

  ```python Python theme={null}
  import os
  import requests

  api_key = os.environ["PAYGOOD_API_KEY"]

  response = requests.get(
      "https://api.paygood.co/payments",
      params={"merchantId": "mer_01example"},
      headers={"Authorization": f"Bearer {api_key}"},
  )

  data = response.json()
  print(data)
  ```
</CodeGroup>

## Authentication failures

If your request is missing the `Authorization` header or your key is invalid, expired, or has been revoked, the API returns a `401 Unauthorized` response:

```json theme={null}
{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}
```

Check that you are using the correct key for the environment you are targeting — your sandbox key will be rejected by the production environment, and vice versa. If you continue to receive `401` errors after verifying your key, [rotate your key](/guides/api-keys) and try again.

<Tip>
  Always read your API key from an environment variable rather than hardcoding it in your source. This prevents accidental exposure in version control and makes it easy to swap keys between environments without changing your code. See [Set Up Your PayGood API Keys](/guides/api-keys) for instructions.
</Tip>