Skip to main content

Bearer Token Authentication

All server-side Grain API requests require your API key passed as a Bearer token in the Authorization header.

Credential Types

Grain uses two types of credentials for different contexts:
Your API key is a server-side secret. Never expose it in client-side code, public repositories, or frontend bundles. If you suspect a key has been compromised, rotate it immediately in the Grain Dashboard.

Session Token Authentication

When you create a payment session, the API returns a paymentSessionToken. This short-lived token is scoped to a single session and used for:
  • Opening the SDK payment modal (sdk.open())
  • Retrieving session details (GET /api/payment-sessions)
Session tokens expire automatically and cannot be reused across sessions. Each POST /payment-sessions call returns a fresh token.

Rotate API Keys

1

Generate a new key

In the Grain Dashboard, go to Settings > API Keys and generate a new key.
2

Update your application

Replace CUBEPAY_API_KEY in your environment variables and deploy.
3

Revoke the old key

Once your application is running with the new key, revoke the old one in the dashboard.

Next Steps

Explore the full list of Endpoints available in the Payment SDK API.