Base URL
/v1/....
Authentication
Send one of two header keys. Both are generated per app in the dashboard.
Test keys only work on sandbox and live keys only on production. A key used in the wrong environment is rejected with 401.
Reading a payment by id needs no key. Webhooks are authenticated the other way round, with a signature you verify. See the webhooks guide.