Skip to main content
Code: auth.keys.secret_in_header
HTTP: 401 Unauthorized

What happened

The API rejected the request during authentication before your route handler ran.

Safe message

We could not verify this request. Please try again later.
Use err.safeMessage or err.displayMessage in customer UI, not err.message.

Why this happened

A raw secret key (sk_*) was sent in a request header. Secret keys must never be transmitted in headers.

How to fix it

Send pk_* in Morapay-Key and sign requests with sk_* server-side only via the SDK.

UI hint

Programmatic handling