Authentication
Credentials accepted by the public Gate partner API.
Gate accepts credentials issued for a 0Bit organization. Use each credential only in its intended environment and runtime.
| Credential | Where it belongs | Gate surface |
|---|---|---|
sk_test_* / sk_live_* |
Partner server only | Sessions, capabilities, quotes, rails, transactions, customers, branding, and dashboard APIs |
pk_test_* / pk_live_* |
Browser | POST /embed/bootstrap only |
| SDK-managed embed token | Gate widget runtime | Returned by bootstrap; partner code should not use it as a server credential |
| Account assertion | Institutional portal memory only | /dashboard/* and POST /webhooks/test |
Secret keys
curl https://gate-api-sandbox.0bit.app/capabilities/currencies \
-H "Authorization: Bearer sk_test_..."
Never place sk_* in HTML, JavaScript bundles, mobile binaries, query strings, analytics, or logs. Gate also accepts the canonical secret-key header where supported by the server guard, but Bearer authorization is the documented form.
Publishable keys
The browser exchanges a publishable key and optional session clientSecret at POST /embed/bootstrap. A publishable key identifies the partner but cannot create sessions or move money.
Dashboard account assertions
The Institutional portal obtains a short-lived RS256 assertion from the 0Bit Account service. Gate accepts it only when it targets gate:dashboard, includes the gate entitlement and account:read, and maps to the same organization and Gate partner. Management actions additionally require account:manage and an OWNER or ADMIN role.
Partner servers may use sk_* on the same dashboard endpoints. Account assertions are browser credentials: keep them in memory, do not persist them, and renew them through the Account session when expired.