Authentication and environments
Pick the correct credential and preserve sandbox/live isolation.
| Credential | Use |
|---|---|
m0_test_ developer key | Sandbox API integration |
m0_live_ developer key | Explicitly enabled live integration |
ag_ agent credential | One authenticated agent on supported agent interfaces |
m0_store_ store key | Installed Shopify or WooCommerce integration |
mcp_ server key | Server-issued merchant MCP endpoint access |
| OAuth access token | Approved remote MCP client |
Compatibility paths accept certain legacy prefixes. For a new connection, use issued credentials rather than inventing or renaming a prefix.
Headers
Native REST routes such as /api/v1/wallets use Authorization: Bearer <key>. Installed store integrations use a store key as a bearer token. MCP accepts bearer credentials or X-Api-Key. The ACP front door is a separate contract using X-Api-Key; inspect its schema before building requests.
Environments
Sandbox credentials resolve to sandbox. OAuth defaults to Sandbox, stored internally as test; live grants require account readiness. Refresh preserves the original environment. A request body or advisory agent-id header cannot select live money.
Permissions
Authentication identifies a caller; scopes and ownership determine allowed operations. Read access does not permit writes. A valid agent credential does not eliminate authority or human-confirmation requirements.
Store secrets
Use a server environment or secret manager. Keep private credentials out of browser code and NEXT_PUBLIC_ variables. The documentation project requires public URLs only: no Clerk secrets, Stripe keys, Redis tokens or database URL.
Rotate exposed credentials, update their consumer, and revoke the old value. Remove credential values from logs and screenshots.