Verified BursaPay gateway workflow: Shows how the gateway authenticates API calls with secret keys.
1. Overview & Purpose
The published gateway guide accepts the secret key in the Authorization header with Bearer syntax or the raw key form.
2. Requirements & Setup
Use a valid active secret key with sufficient scope.
3. Step-by-Step Workflow
- Create a server-side API request.
- Set Authorization to Bearer sk_test_... or the supported raw form.
- Send the request to the /api/v1/ endpoint.
- Handle authentication failures without exposing the secret.
4. Rules & Troubleshooting
Never place secret keys in browser JavaScript, public repositories or logs.
5. Verification & Next Steps
Move the credential into the server-side environment before production use.