@lang('Authentication')

{{ setting('site_title') }} @lang('API uses API keys to authenticate requests. You can obtain your credentials from your merchant dashboard.')

@lang('Environment-Aware API Integration')

{{ setting('site_title') }} @lang('API supports both sandbox (testing) and production environments. Always test in sandbox first before going live.')

@lang('Environment Configuration')

@lang('Sandbox Mode')

@lang('Use for:') @lang('Development, testing, integration')

@lang('X-Environment:') sandbox

@lang('Credentials:') @lang('Use test_* prefixed API keys')

@lang('Production Mode')

@lang('Use for:') @lang('Live payments, real money')

@lang('X-Environment:') production

@lang('Credentials:') @lang('Use production API keys (no prefix)')

@lang('Gateway Configuration') @lang('Payment gateway selection is dashboard-managed. After generating API credentials, open Merchant -> Config -> Payment Gateway Controls to choose eligible gateways without changing your integration keys.')

@lang('Signed requests') @lang('Every API call must include X-Timestamp and X-Signature unless merchant API signatures are disabled by admin configuration.')

@lang('Replay protection') @lang('The timestamp must be fresh. Default tolerance is 300 seconds, configurable by admin.')

@lang('Rate limit') @lang('Merchant API calls are rate limited per merchant and IP. Default limit is 120 requests per minute.')

@lang('Required Credentials')

@lang('Credential')	@lang('Header')	@lang('Description')	@lang('Location')
`@lang('Merchant ID')`	`X-Merchant-Key`	@lang('Your unique merchant identifier')	@lang('Dashboard') → @lang('Merchant') → @lang('Config')
`@lang('API Key')`	`X-API-Key`	@lang('API authentication key')	@lang('Dashboard') → @lang('Merchant') → @lang('Config')
`@lang('Request Timestamp')`	`X-Timestamp`	@lang('Unix timestamp in seconds used for replay protection')	@lang('Generated by your server for each API request')
`@lang('API Signature')`	`X-Signature`	@lang('HMAC-SHA256 signature for the request')	@lang('Generated using your Client Secret')
`@lang('Client Secret')`	-	@lang('Used for API request signing and webhook signature verification')	@lang('Dashboard') → @lang('Merchant') → @lang('CONFIG')
@lang('Production API Key')	`X-API-Key`	@lang('Production API key (no prefix)')	@lang('Merchant Dashboard') > @lang('API Config') > @lang('Production Mode')
@lang('Production Merchant Key')	`X-Merchant-Key`	@lang('Production merchant identifier (no prefix)')	@lang('Merchant Dashboard') > @lang('API Config') > @lang('Production Mode')

@lang('Security Notice') @lang('Never expose your Client Secret in client-side code. Store all credentials securely on your server.')

@lang('Signature Payload')

@lang('When API signatures are required, sign this exact payload with your Client Secret:')

timestamp.HTTP_METHOD.path_with_query.raw_body