Authentication

Authorization: Bearer gs_test_…

Key types

• gs_test_… — Sandbox keys. Only accepted by the Sandbox base URL.
• gs_live_… — Live keys. Only accepted by the Live base URL, and only for organizations approved for Live.

Using a key against the wrong base URL returns 401 environment_mismatch. The server never retries the request in the other environment.

Scopes

Each key is limited to the scopes chosen when it was created. Missing scopes return 403 insufficient_scope.

• balances:read — Read wallet balances.
• transfers:read — List and retrieve transfers.
• transfers:write — Create transfers (and, in Sandbox, add test funds).
• cards:read — List and retrieve cards and card transactions.
• cards:write — Issue, fund, withdraw from, freeze and terminate cards.
• cards:sensitive — Reveal full card number and CVV. Grant only to PCI-compliant systems.

Creating, rotating and revoking keys

• The full secret is displayed once at creation. GLORESEND stores only a keyed hash, so a lost secret cannot be recovered — rotate instead.
• Keys can expire after a chosen number of days.
• Rotate issues a new secret with the same name and scopes. The old key stops working immediately, or after a grace period of up to 72 hours so you can deploy the new secret first.
• Revoke disables a key immediately.
• The dashboard shows each key’s prefix, status, scopes, creation time and last use.

Live keys

Creating or rotating a Live key requires all of the following:

1. The organization’s Live access has been approved (see Sandbox & Live).
2. You are an owner or admin of the organization.
3. Two-factor authentication is enabled on your account.
4. You confirmed your password within the last 15 minutes.