API Keys

Merchant API requests use bearer authentication:

Authorization: Bearer <sandbox-api-key>

The API key identifies the merchant. Never send a merchantId to select a tenant.

API keys may be expired or revoked. Store issued sandbox keys securely and do not embed them in browser JavaScript.

Sparelane issues keys only for approved sandbox pilots. Keys are shown once to the authorised technical contact and are stored by Sparelane only as hashes.

Merchant Identity

Use GET /merchant to confirm which merchant an API key represents.

Rotation And Revocation

If a key is exposed or a pilot ends, ask Sparelane to revoke it. Replacement keys are issued as new credentials; old revoked keys return JSON 401 responses.

If you need a planned rotation, request a replacement key before changing your integration configuration. After you confirm the new key works, ask Sparelane to revoke the old key.