Authentication

Pesarc developer endpoints authenticate with a secret key sent as a bearer token:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx

Each merchant has their own key, so a verified key also tells Pesarc which account to scope the request to.

Getting a key

In the app, open Developers and create a key. The full secret is shown once; copy it right away.
Over the API, see API keys.

Keeping keys safe

Your secret key can move money and read your account. Protect it:

Keep it server-side only, never in browser or mobile client code.
Never commit it to source control; load it from an environment variable.
Rotate immediately if it may have leaked: revoke the old key and create a new one in Developers.

Restricting by IP (allowlist)

You can restrict which source IPs may use your account’s keys. In Developers → Allowed IPs, add a single IP or an IPv4 range (for example 203.0.113.7 or 203.0.113.0/24).

While the list is empty, requests are accepted from any IP.
Once you add one entry, only listed IPs may call the API with your keys; every other source IP is rejected with 403:

{
  "error": {
    "type": "authentication_error",
    "message": "Source IP … is not allowed for this account. Add it to your API IP allowlist."
  }
}

Add your server’s egress IP(s) before switching traffic over, so you don’t lock out your own integration. Behind a NAT or a fixed egress range, a CIDR like 203.0.113.0/24 covers the whole block.

Missing or invalid keys

A request with no key returns 401:

{
  "error": {
    "type": "authentication_error",
    "message": "Missing API key. Send Authorization: Bearer sk_live_…"
  }
}

An invalid or revoked key also returns 401. Confirm a key quickly with GET /v1/ping.