A public key (pk./pk_test.) is accepted on /payments, /customers, /links, /invoices and the catalogue reads (/channels, /providers, /countries, /currencies); anything that moves money out, reads the balance or manages the account answers 406 to it. It is an identifier, never an authorization. Use a secret key (sk./sk_test.) for sensitive operations (transfers, refunds, balance), or a restricted key (rk./rk_test.) scoped to specific permissions. The _test. variant of any key selects the sandbox environment, there is no separate sandbox URL. Never expose your secret key in client-side code.

In: header