Authentication

All API requests require authentication via the X-SECRET-KEY HTTP header:

The secret key determines the platform and environment (live or test). Without X-ACCOUNT-ID, requests operate on that same account.

Connected account context

If the key belongs to a platform, add X-ACCOUNT-ID to execute a request inside a connected child, like Stripe-Account in Stripe Connect:

$
curl https://app.recurrente.com/api/intents \
>
  -H "X-SECRET-KEY: sk_live_xyz789..." \
>
  -H "X-ACCOUNT-ID: ac_child123"

The platform can list, retrieve, and manage API resources belonging to that child regardless of whether the platform or the child created them. The context covers checkouts, customers, products, subscriptions, intents, payment intents, refunds, balances, transfers, and other account-owned resources.

Only accounts directly connected to the API-key owner are accepted. Access is not transitive to accounts connected to the child. Endpoints under /connected_accounts remain platform operations and take the child ID in the path. Endpoints that already accept account_id keep it as a compatibility alias. Key capabilities, account verification, and money-movement destination restrictions still apply inside the connected context.

Finding Your Keys

To find your API Keys, within your Recurrente account, go to:

Settings → API Keys.

1. Log in to the Recurrente Dashboard
2. Go to Settings → API Keys
3. Copy your secret key. It is only shown in full when generated or rotated.

Live vs Test Mode

Your account has two secret keys:

• Test keys — Use these during development. No real money is moved.
• Live keys — Use these in production. Real transactions are processed.

The API endpoint is the same for both modes. The secret key determines which environment you’re operating in.

Example Request

$
curl https://app.recurrente.com/api/test \
>
  -H "X-SECRET-KEY: sk_live_xyz789..."

Authentication Error

If your API keys are not being sent or are invalid, you will receive an HTTP 401 Unauthorized response code:

1
{
2
  "message": "Autenticación Errónea 👀",
3
  "errors": {
4
    "authentication": [
5
      "Las llaves de API son inválidas o no coinciden."
6
    ]
7
  }
8
}

Environments