Authentication

Authenticated routes require two headers:

Header	Description
`X-Merchant-Key`	Public key id, prefixed `mk_` (for example `mk_a1b2c3…`)
`X-Merchant-Secret`	Secret shown once when the key was issued

Example


curl "https://api.subthingy.io/v1/wallet/balance" \
  -H "X-Merchant-Key: mk_your_key_id" \
  -H "X-Merchant-Secret: your_issued_secret"

Send both headers on every protected route.
Keys are scoped to your merchant profile.
Expired or wrong credentials return 401.
Rotate keys through your account administrator when staff or vendors change.
Live vs. test is determined by which key you send — your merchant profile has one credential pair for live traffic and a separate one for test traffic, both valid against the same base URL. See Environments.

GET /healthz does not require credentials.