Authentication Errors

Errors use a consistent envelope:

{
  "error": {
    "code": "authentication_required",
    "message": "Bearer authentication is required."
  }
}

Common codes include:

• authentication_required
• invalid_api_key
• api_key_expired
• api_key_revoked
• merchant_inactive
• rate_limit_exceeded
• internal_error

Rate-limited responses use 429. If the required distributed rate-limit store is unavailable in the dedicated merchant API deployment, requests fail closed with 503.