Authentication

Every request is authenticated with a bearer token: a secret API key or an OAuth 2.0 access token.

API keys

Keys are created in the console under Developers → API keys. Live keys start with sk_live_ and sandbox keys with sk_test_. Each key has scopes (for example collect:write, payouts:write, shield:read) and a pinned API version.

cURL

curl https://api.neofin.tech/v1/collection-accounts \
  -H "Authorization: Bearer sk_live_..."

OAuth 2.0 client credentials

For server-to-server integrations that prefer short-lived tokens, exchange a client ID and secret for an access token valid for one hour.

cURL

curl https://api.neofin.tech/v1/oauth/token \
  -u "client_id:client_secret" \
  -d grant_type=client_credentials \
  -d scope="collect:write credits:read"

{ "access_token": "eyJhbGciOi...", "token_type": "bearer", "expires_in": 3600 }

Rotation

Keys can be rotated from the console with an overlap window of up to 24 hours during which both old and new keys work. Rotate immediately if a key may have been exposed.

Rate limits

The default limit is 600 requests per minute per key. Exceeding it returns 429 with a Retry-After header. Institutional plans can request higher limits.

Never use a secret key in a browser or mobile app. Keys must only be used from your servers.