When you sign up for an account, you can authenticate with either Access keys (OAuth 2.0), or Secret API keys. Unless explicitly stated, all endpoints require authentication using either your Access or Secret API Keys. Public keys should only be used in JavaScript or native applications.
Client-side authentication. Use your public key for client-side authentication. It only has access to a limited set of our APIs – mostly those called as part of your payment environment.
Server-to-server authentication. Use your secret key or OAuth for server-to-server communication. Support for API keys depends on the endpoint.
Never share your OAuth credentials, API keys, or access tokens. Keep them guarded and secure.