# Authentication

Every request needs one of your secret API keys, sent as a Bearer token.

```http
GET /v1/balance
Host: api.weavpayments.com
Authorization: Bearer wv_test_••••••••••••••••
```

## Live and test keys

| Prefix | Mode | What it does |
| --- | --- | --- |
| `wv_live_` | Live | Real payments, real money, real webhooks. |
| `wv_test_` | Test | Simulated payments that you finish on the test checkout page. No money moves. |

The key's prefix decides the mode. Live keys never see test data, and test keys never see live data.

## Managing keys

- Create, rename, regenerate and delete keys under Developers in the dashboard.
- Weav shows a key in full only once, when you create it. Store it in your secrets manager right away.
- Regenerating a key stops the old one immediately.
- You can limit a key to your servers' addresses. See [IP allowlist](#ip-allowlist).
- Never put a key in a mobile app, a browser, or a public repository. Call Weav only from your server.

## IP allowlist

Limit a key to your servers' addresses, so a key that leaks can't be used from anywhere else. We recommend it for every live key.

- Set it per key under Developers in the dashboard, when you create or edit the key. An empty list allows any address.
- Up to 20 entries: IPv4 or IPv6 addresses, or ranges in CIDR notation, such as `203.0.113.10` or `203.0.113.0/24`. Separate them with commas, spaces or new lines.
- Use the public address your servers call out from: the one Weav sees. Behind a NAT gateway, load balancer or proxy, that's its public address, not your server's private one.
- A change to a live key's allowlist is emailed to your account's Owners and Developers.
- [Try it](https://docs.weavpayments.com/reference#try-it) on these docs calls Weav from your browser, so a key with an allowlist gets `403` there. Use a test key without one.

A request from any other address gets `403`:

```json title="403 Forbidden"
{
    "code": "4030000",
    "success": false,
    "message": "Requests with this key must come from an address on its allowlist."
}
```

To call Weav, use the host name `api.weavpayments.com`, never an IP address: Weav's own addresses can change. Webhooks come to you from fixed addresses; see [IP addresses](https://docs.weavpayments.com/webhooks/ip-addresses).

## Errors

| Status | When |
| --- | --- |
| `401` | The key is missing, wrong, revoked or regenerated. |
| `403` | The key is valid, but the request came from an address outside its allowlist, a live key was sent from a browser (code `4030001`), your account isn’t active, or it’s a live key and live mode isn’t on for your account yet. |