API reference
Authentication
gm_live_ keys, a Bearer header, and what the server keeps.
Every /v1/* route requires an API key, except the payment webhook, which
ClicToPay calls directly and the gateway verifies server-side.
The header#
Authorization: Bearer gm_live_...Key format#
A key is the prefix gm_live_ followed by 32 random bytes in base64url. The
server never stores the value: it keeps sha256(key) and an 11-character
prefix, purely so you can recognise your own keys in a list.
Revoking#
Delete a key from API keys on gamra.dev. Revocation
takes effect immediately: the next request gets a 401 with the code
invalid_api_key.
Tracing a request#
Every response from the proxy route carries an x-gamra-request-id header. Log
it. It is the same id the usage ledger records, and it is what makes a specific
request findable if it is ever disputed.