Bearer Token Authentication
All server-side Grain API requests require your API key passed as a Bearer token in theAuthorization header.
Credential Types
Grain uses two types of credentials for different contexts:Session Token Authentication
When you create a payment session, the API returns apaymentSessionToken. This short-lived token is scoped to a single session and used for:
- Opening the SDK payment modal (
sdk.open()) - Retrieving session details (
GET /api/payment-sessions)
Session tokens expire automatically and cannot be reused across sessions. Each
POST /payment-sessions call returns a fresh token.Rotate API Keys
1
Generate a new key
In the Grain Dashboard, go to Settings > API Keys and generate a new key.
2
Update your application
Replace
CUBEPAY_API_KEY in your environment variables and deploy.3
Revoke the old key
Once your application is running with the new key, revoke the old one in the dashboard.