> ## Documentation Index
> Fetch the complete documentation index at: https://docs.puffinmoney.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys, rate limits, and errors

## API keys

Server-to-server endpoints authenticate with the `X-API-Key` header:

```bash theme={null}
curl https://api.puffinmoney.com/v1/gateway/api/payment-intents/9b1f... \
  -H "X-API-Key: mk_live_..."
```

* Keys are shown **once** at creation and stored hashed (SHA-256).
* Revoke and rotate anytime from the dashboard (`DEVELOPER` role or above).
* Never use an API key in browser or mobile code — use
  [payment links](/payment-links) or the [iframe SDK](/embed) client-side.

## Rate limits

120 requests/minute per IP. `429` responses include standard
`X-RateLimit-*` headers.

## Errors

```json theme={null}
{ "error": { "code": "invalid_api_key", "message": "Invalid or revoked API key" } }
```

| Code                                  | Meaning                                        |
| ------------------------------------- | ---------------------------------------------- |
| `missing_api_key` / `invalid_api_key` | Header absent, revoked, or merchant not active |
| `unsupported_asset`                   | Token/chain pair not supported                 |
| `validation_error`                    | Malformed body — message names the field       |
| `not_found`                           | Resource doesn't exist or isn't yours          |
| `plan_limit`                          | Wallet/team quota reached — upgrade your plan  |