Authentication

All Partner API requests require a Bearer API key.

http

Authorization: Bearer <YOUR_API_KEY>

Header	Required	Description
`Authorization`	Yes	`Bearer <api_key>`
`Content-Type`	For JSON bodies	`application/json`

API keys

Keys are environment-scoped and issued from the Developer portal.

Prefix	Environment
`taappa_test_sk_*`	Test
`taappa_live_sk_*`	Live

Keep keys on your server. Never embed them in client apps.

Your key determines the wallet provider. Do not send a provider field in the request body.

Status	Detail
`401`	`Not authenticated` / missing `Authorization` header
`401`	`Invalid API key` / invalid or revoked key

Limits apply per API key. Test and live keys are counted separately.

Surface	Limit
Digital card APIs	1,000 requests / minute
Physical card & replacement APIs	1,000 requests / minute

When exceeded, the API returns 429 Too Many Requests:

http

RateLimit-Limit: 1000
RateLimit-Remaining: 0
RateLimit-Reset: 42
Retry-After: 42

RateLimit-Reset and Retry-After are seconds until the window resets.

Creation endpoints accept an optional Idempotency-Key header:

http

Idempotency-Key: 7c9e6679-7425-40de-944b-e07fc1f90ae7

Status	Meaning
`200`	Success, or a safe replay of a completed request
`409`	Same key is already in progress
`422`	Same key was used with a different body

Keys are scoped to your institution, environment, and endpoint. Replays are retained for 24 hours.