Authentication - Zahlo Merchant Developer Docs

Keep the merchant API key in server-only configuration. Browser code receives only the short-lived client token returned by a trusted server endpoint.

Merchant API keys

Send the merchant API key in the x-api-key header from trusted server code:

curl https://merchant-demo.zahlo.eu/api/v1/payment-methods \
  -H 'x-api-key: ${ZAHLO_API_KEY}'

Do not put merchant API keys in browser JavaScript, mobile bundles, source control, URLs, analytics events, or client-visible HTML. Rotate a key immediately if it may have been exposed.

Client tokens

Checkout session creation returns a short-lived client token for the browser. Send it as Authorization: Bearer <clientToken> when reading or continuing that session. Client tokens are scoped to one session and expire automatically.

Headers

Header	Used for
`x-api-key`	Trusted merchant server requests
`Authorization: Bearer ...`	Browser access to one checkout session
`Idempotency-Key`	Safe retries of create requests
`Content-Type: application/json`	JSON request bodies

Key lifecycle

Create separate Demo and production keys, store them in a secret manager, restrict access to the server process, rotate them on a schedule, and remove old keys after all integrations have migrated.