> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kemypay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, allowed IP addresses and environments

Every request carries your **secret API key** in the `Authorization` header:

```bash theme={null}
curl https://api.kemypay.com/v1/mobile-money/countries \
  -H "Authorization: Bearer sk_live_YOUR_KEY"
```

| Key | Mode | Money |
| - | - | - |
| `sk_test_…` | Test | None. Every outcome is simulated. |
| `sk_live_…` | Live | Real payments from real customers. |

Test and live data never mix: a test key only sees test payments and test balances.

## Allowed IP addresses

Requests are accepted only from the IP addresses you allowed in your dashboard. Add the public IPs of your servers before your first call. A request from another address is refused with `403 IP_NOT_ALLOWED`, even with a valid key.

> [!WARNING]
>
> **Never call the API from a mobile app or a browser.** Your secret key would be readable by anyone. Your app talks to your server; your server talks to KemyPay.

## Base URL

```
https://api.kemypay.com/v1
```

## Errors

A missing key returns `401 AUTHENTICATION_REQUIRED`, a wrong key `401 AUTHENTICATION_FAILED`. Too many requests return `429 RATE_LIMIT_EXCEEDED`. See [Errors](https://docs.kemypay.com/guides/errors.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.