Authentication
Bearer secret keys, environments, and IP allowlists.
Authentication
Send your secret key as a Bearer token on every request:
Authorization: Bearer sk_live_xxxxxxxxxxxxxYour company and the accounts the key may access are resolved from the key. Never send a company identifier in a header — it is ignored.
Key prefixes
| Prefix | Environment |
|---|---|
sk_live_ | Production (live gateway for this docs deploy) |
sk_test_ | Sandbox (sandbox gateway for this docs deploy) |
Current bases: live https://gateway.momen.co/v1, sandbox https://gateway-sandbox.momen.co/v1.
The key prefix selects the environment. Each key only works on its own base URL. A sandbox key on production (or the reverse) returns 401 with api_key_wrong_environment.
Shown once
Secret keys are shown once, when created. Momen stores only a hash and a short preview and cannot recover a lost key. Create a new one instead.
IP allowlist (live only)
If you register one or more IP addresses under Settings → Developer, production requests must originate from one of them. Other addresses are rejected with 403 (ip_not_allowed).
With no addresses registered, requests are accepted from any address — registering your servers' addresses is strongly recommended.
Sandbox does not check IPs.
Scopes
Each secret key is granted one or more product scopes when it is created under Settings → Developer. An endpoint only accepts keys that hold its scope:
| Scope | Endpoints |
|---|---|
cash_management | Payment Links, Accounts |
ewa | Employees, EWA Requests, Branches |
Both scope failures return 403. Branch on error.code:
product_not_enabled— your company does not have this product, or it is unavailable. Contact Momen.insufficient_scope— your company has the product, but this key was not granted its scope. Add the scope to the key under Settings → Developer.
Public keys
Public keys (pk_) are not accepted by any endpoint yet (public_key_not_accepted).