---
title: Authentication
description: Every request carries a project API key. A key's permissions decide whether it can only take money in or can also send money out.
---

RazPay uses per-project API keys. Send the key as a Bearer token on every request:

```http
Authorization: Bearer rzp_live_ab12cd34ef56gh78ij90kl12mn34op56qr78st
```

Requests must use HTTPS. A key belongs to one project, so every request is scoped to that project's transactions, providers and settings.

## Creating and revoking keys

Org admins create keys from the project's page in the dashboard, under **API keys**. A key is shown in full **exactly once**, when it's created. RazPay stores only a hash of it, so a lost key can't be recovered: revoke it and create a new one.

Keys are either `live` or `test`. Revoking a key takes effect immediately.

:::warning
Never put an API key in client-side code, a mobile app or a public repository. Keep it in environment variables or a secrets manager on your server.
:::

## Permissions

A key's permissions decide what it may do. Choose them when you create the key.

| Permission | Allows |
| --- | --- |
| `collect` | Collecting payments, pre-approvals, invoices and messages to payers. |
| `payout` | Sending payouts from your disbursement account, and reading them back. |
| `refund` | Refunding successful payments. |

Every key can read: transactions, providers, wallet checks and balances need no extra permission.

`payout` and `refund` move money **out** of your accounts, so they are never granted by default. Give them only to the keys that need them, ideally a separate key on a separate service. Keys created before permissions existed have `collect` only.

A key without the permission an endpoint needs gets a `403`:

```json
{
  "success": false,
  "message": "this API key does not have the payout permission",
  "data": null
}
```