Authentication

Every /v1 request authenticates with a secret test-mode key. Keys start with mock_sk_. Provision them in the Mockpay app; the plaintext value is shown exactly once.

Presenting the key

Bearer header:

curl https://api.mockpay.net/v1/payment_intents \
  -H "Authorization: Bearer mock_sk_51H8sandbox..."

Basic auth with the key as username (Stripe convention) also works:

curl https://api.mockpay.net/v1/payment_intents \
  -u mock_sk_51H8sandbox...:

Failure modes

  • Missing, malformed, revoked, or expired key → 401 Unauthorized with a Stripe-shaped invalid_request_error.
  • Valid key, unreleased resource → 404 invalid_request_error naming the unrecognized URL, until the resource's milestone ships.

Key lifecycle

  • Keys are hashed at rest; Mockpay cannot re-display them.
  • Keys never expire unless provisioned with an expiry.
  • Revocation is immediate.