Authentication

​

Secret keys (server-to-server)

curl https://api.useduro.com/v1/plans \
  -H "Authorization: Bearer sk_test_•••••••••••••••••"

• The prefix selects the mode: sk_test_… → sandbox, sk_live_… → live.
• Keys are hashed at rest — Duro can’t show you a key again after creation, so store it securely.
• Keys carry full scope within their tenant. Treat a live secret key like a password.
• A publishable key (pk_…) is safe to expose in the browser/SDK; it can start checkout sessions but can’t read or mutate data.

​

OAuth2 (client credentials)

curl https://api.useduro.com/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{ "grant_type": "client_credentials", "client_id": "cid_test_•••", "client_secret": "csec_test_•••" }'

​

Customer identity tokens

​

Errors