Authenticate safely

Moneybag public payment APIs use X-Merchant-API-Key. Send it only from a trusted server to the sandbox API origin while developing.

Environment separation

Use different keys for sandbox and production. Bind the server origin and key in deployment configuration, fail closed when either is missing, and never select production from a request parameter.

curl https://sandbox.api.moneybag.com.bd/api/v2/payments/subscription-plans \
  -H "X-Merchant-API-Key: $MONEYBAG_SANDBOX_API_KEY"

The API Lab follows the same boundary: the key lives in an encrypted HttpOnly session and is injected by the platform BFF only for reviewed sandbox paths.