Authentication

Authenticated provider calls use a Bearer API key.

Authorization: Bearer <YOUR_API_KEY>
Content-Type: application/json

Never put a real key in documentation, source control, or browser JavaScript.

Rules

Sandbox keys work only on https://sandbox-api.studentpay.co.nz
Production keys work only on https://api.studentpay.co.nz
Keys are provider-specific. The key must match provider.provider_code in the request body
Do not reuse a production key in sandbox, or the reverse
Call StudentPay from your backend. Do not embed keys in enrolment pages

Public endpoints

These do not require a key:

GET /v1
GET /v1/environment

Use them to confirm the host and readiness before you send student data.

Provider codes

StudentPay issues a provider_code with each key. Sandbox examples in this site use SANDBOX_DEMO.

Issued codes such as BELA_NZ are assigned to a specific provider. Seeing a code in an example does not mean that provider’s credentials are public.

Failure modes

v1 wraps authentication failures in the standard error envelope.

Code	HTTP	When
`MISSING_API_KEY`	401	`Authorization` header absent or empty
`INVALID_API_KEY`	403	Bearer token is not a recognised key
`PROVIDER_KEY_MISMATCH`	403	Key does not match `provider.provider_code`

See Errors.

Obtaining keys

Ask StudentPay for a sandbox key first. Production keys are issued separately after sandbox integration. Contact partners@studentpay.com.au.