Authentication

Authenticate every request with your secret key as a bearer token. Keys look like bst_live_3f9c21a0b7e4_… (live) or bst_test_… (test).

curl https://api.brightsecuretech.com/v1/payments/BST-4F9A21C0D7E3 \
  -H "Authorization: Bearer $BST_SECRET_KEY"

Idempotency-Key

Every request that creates something must carry an Idempotency-Key header: 8 to 128 characters of letters, digits, _ - : or . Use your own order ID. If the network fails and you retry with the same key and the same body, you get the original result back (HTTP 200 with Idempotent-Replayed: true) and the customer is never charged twice. The same key with a different body is refused with 409.