Authentication and security

API keys

Send your secret key as a bearer token on every request:

Authorization: Bearer aura_live_…

Environment	Key starts	Base URL
Sandbox	aura_test_	https://sandbox.api.poweredbyaura.com/v1
Production	aura_live_	https://api.poweredbyaura.com/v1

A key works only in its own environment. A missing, wrong or revoked key gets 401 invalid_api_key. The API is served over HTTPS only.

Keys are issued by your technical contact. There is no dashboard and no endpoint that creates keys.

Keys belong on your servers

A key can spend your balance. Keep it in a secret store and call the API only from your back end. Never put a key in a mobile app, a web page, source control or a log line.

IP allowlist

You can ask for production requests to be accepted only from addresses you name. A request from anywhere else gets 403 ip_not_allowed, even with a valid key. Agree the list with your technical contact, and tell them before your outbound addresses change.

Rotating a key

1. Ask your technical contact for a new key.
2. Deploy it. The old and new keys both work while you switch.
3. Tell your technical contact when you have switched, and the old key is revoked.

If a key leaks

Tell your technical contact straight away. They revoke the key and issue a new one. Then check your recent purchases and statement for anything you did not make.

Webhook secret

Your webhook secret is separate from your API key. Aura uses it to sign every webhook so you can prove it came from Aura. See verifying webhooks.