Unauthorized (401)

The API key is missing, malformed, unknown, revoked — or a valid key of the wrong mode (an sk_live_ key on the sandbox, or sk_test_ on production). The response is deliberately identical in every case: an unauthenticated caller learns nothing about which keys exist.

What to do

• Send Authorization: Bearer sk_test_... (sandbox) or Bearer sk_live_... (production) on every /v1/* and /sandbox/* request.
• Check you are calling the environment that matches the key's prefix.
• Keys are shown once at issuance. If yours is lost, request a new one — there is no recovery.