Authentication
TabEdge uses secret API keys to authenticate requests to the Developer API. Every key belongs to one Business and must be sent in the Authorization header.
Authorization Header
Authorization: Bearer tb_sk_live_YOUR_API_KEYReplace the placeholder with your actual secret API key.
API Key Environments
| Environment | Key Prefix |
|---|---|
| Live | tb_sk_live_ |
| Test | tb_sk_test_ |
The API key environment must match the associated Business environment. Environment mismatches return HTTP 409.
Business-scoped Keys
Each API key is bound to one Business. TabEdge verifies that the Business exists and belongs to the key owner. You do not need to send a separate businessId in Checkout API requests.
Legacy merchantId-only keys are not accepted by the Business-aware Developer API.
Example Request
curl https://www.tabedge.com/api/platform/v1/checkouts/CHECKOUT_ID \
-H "Authorization: Bearer tb_sk_live_YOUR_API_KEY"Authentication Errors
| HTTP | Reason |
|---|---|
| 401 | Missing or malformed API key |
| 401 | Invalid API key format or unknown key |
| 401 | Revoked API key |
| 401 | API key is not bound to a valid Business |
| 401 | Business ownership mismatch |
| 409 | API key environment does not match Business environment |
Protect Your API Keys
Never expose secret API keys in browser JavaScript, public repositories, or client-side WordPress code. Store keys in secure server-side environment variables. Revoke compromised keys from the dashboard.