Authentication

Every server-to-server call is authenticated with a single API key, sent as a bearer token.

Create a key

From your company's Commerce Developer Portal, create an API key and choose which scopes it needs — checkout:write, payout_embed:write, and/or split:write. Grant only what your integration actually calls. The full secret is shown once at creation (bk_live_...) — store it somewhere safe. You can reveal it again later from the portal if you lose track of it.

Only one active key is allowed per company at a time. To rotate, revoke the current key and create a new one.

Use it

Send it as an Authorization: Bearer header on every request to an integration endpoint (anything under /api/commerce/integration/*).

authenticated-request.sh

curl https://api.nest.useblitz.co/api/commerce/integration/checkout \
  -H "Authorization: Bearer bk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ ... }'

Keep your key server-side only. Anyone with it can act on your company's behalf within whatever scopes it carries — never ship it to a browser or a mobile app.

Scopes

checkout:write — create an integration checkout (Checkout, Flow B).
payout_embed:write — create a Payout Embed session.
split:write — create a Split.

A request against a route your key isn't scoped for is rejected — check the scopes you selected if you get an unexpected 403.