Authentication

Every authenticated v1 request requires a provider API key as a Bearer token.

Authorization: Bearer <PROVIDER_API_KEY>
Content-Type: application/json

Rules

Use a sandbox key against sandbox-api.studentpay.com.au
Use a separate production key against api.studentpay.com.au
The key must belong to the same provider.provider_code sent in the request body
Never embed API keys in client-side / browser code — call StudentPay from your backend

Public endpoints

GET /v1/environment does not require authentication. Use it to confirm sandbox vs production and readiness before integrating.

Obtaining keys

Sandbox and production keys are issued by StudentPay for each education provider (or demo provider such as SANDBOX_DEMO). Contact dsherwood@studentpay.com.au if you need access.

Failure modes

Code	HTTP	Meaning
`MISSING_API_KEY`	401	`Authorization` header absent
`INVALID_API_KEY`	403	Bearer token not recognised
`PROVIDER_KEY_MISMATCH`	403	Key does not match `provider_code`

See Errors for the full envelope.