generated: '2026-08-02'
method: searched
source: openapi/scalapay-openapi-original.yml
docs: https://developers.scalapay.com/reference/api-architecture
summary:
  types:
  - apiKey
  api_key_in:
  - header
  oauth2_flows: []
  model: static bearer API key, environment-scoped, with a second device-scoped key for in-store
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  format: 'Bearer <secret_api_key>'
  description: API key authentication using the Authorization header with a Bearer token.
  applies_to: default security for all operations (online orders, payments, reporting)
  key_prefix: sp_
  sources:
  - openapi/scalapay-openapi-original.yml
- name: InstoreApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  format: 'Bearer <device_api_key>'
  description: API key authentication for instore endpoints using the Authorization header with a Bearer token.
  applies_to:
  - POST /v1/instore/orders
  - GET /v1/instore/orders/{token}
  - GET /v1/instore/orders/references
  - POST /v1/instore/orders/{token}/refund
  - POST /v2/instore/paybylink/orders
  - POST /v2/instore/paybylink/orders/{token}/void
  note: >-
    Declared in components.securitySchemes alongside ApiKeyAuth. The pay-by-link operations explicitly
    require the device bearer token, not the merchant token. The mechanical derive pass only surfaced
    ApiKeyAuth because it is the sole scheme in the document-level security[] block; this scheme was
    added from the specification's components and the in-store reference pages.
  sources:
  - openapi/scalapay-openapi-original.yml
key_management:
  issuer: Scalapay Merchant Portal (Developer section)
  portal: https://partner.scalapay.com/login
  environment_scoped: true
  environments:
    - {name: sandbox, base_url: 'https://integration.api.scalapay.com'}
    - {name: production, base_url: 'https://api.scalapay.com'}
  rotation_policy: not published
  expiry: not published
  scopes: none — the key is unscoped; there is no OAuth or permission model
failure:
  status: 401
  body: '"Unauthorized"'
  note: >-
    The 401 body is a bare JSON string, not the {errorCode, errorId, message, httpStatusCode} envelope
    used by other errors. Documented causes are a missing "Bearer " prefix, more than one space after
    "Bearer", or using the wrong environment's key.
transport_security:
  tls_minimum: TLS 1.2
  observed: TLSv1.3 on api.scalapay.com and integration.api.scalapay.com
  hsts: true
  hsts_max_age: 63072000
  artifact: security/scalapay-domain-security.yml
oidc: false
oauth2: false
mtls: false
x-evidence:
  fetched: '2026-08-02'
  urls:
    - https://developers.scalapay.com/reference/api-architecture
    - https://developers.scalapay.com/reference/post_v1-instore-orders
    - https://developers.scalapay.com/reference/post_v2-instore-paybylink-orders