Sandbox Only

Authentication & API keys

Scoped, server-side credentials. A public product ID is never a substitute for authorization.

Build in sandbox. These guides describe the current implementation. Live payments and payouts are disabled; planned capabilities are labelled explicitly.

Create a sandbox key

Open API & Webhooks in your merchant dashboard. Create a named key with only the scopes you need. The secret is displayed once, stored hashed, and expires after 90 days. At most ten active keys are allowed. Lost secrets cannot be recovered: revoke and replace them.

Check your connection

bash

curl --fail-with-body https://api.unalaunch.com/api/v1/integration/ping \
  -H "Authorization: Bearer $UNA_SANDBOX_KEY"

Choose narrow scopes

catalog:read lists products. orders:read lists your orders. checkout:links generates links for your published products. Sandbox keys do not create catalog products through this external API today; use the dashboard. Session-authenticated dashboard endpoints are a separate interface.

Rotate and revoke

Generate a replacement, update your protected server environment and revoke the old key. A revoked or expired key returns 401. Scope failures return 403. Keys cannot access another merchant, live payments, banking credentials or administrative functions.