Authentication & Environments

Lydian authenticates every API request with a key you generate in the Merchant Portal. There are two key types for API access, each sent in its own header.

API keys

	Publishable Key	API Key
Prefix	pk_	ak_
Header	X-Publishable-Key: pk_...	X-Api-Key: ak_...
Intended use	Frontend / browser code	Server-to-server only
Merchant selection	Encoded in the key — append :{EXTERNAL_MID} to target a sub-merchant	Sent in the X-MID header

• Publishable Key (pk_) is safe to use from frontend code. Use it to create a Session or Transaction.
• API Key (ak_) is for server-to-server calls only — keep it secret. Use it for account, merchant, key, refund, reporting, and webhook management. When an API Key acts on a specific merchant (for example creating a session), send that merchant in the X-MID header.

For a deeper explanation of when to use each, see API Key vs Publishable Key. To create, list, or revoke keys programmatically, see the Authentication API reference.

Environments

Lydian provides separate sandbox and production environments, each with its own keys and dashboard.

Environment	API base URL ({API_BASE_URL})	Merchant Portal
Sandbox	https://api.sandbox.lydian.com	merchant.sandbox.lydian.com
Production	https://api.lydian.com	merchant.lydian.com

Start in sandbox to test your integration end to end, then switch the base URL and keys to production to go live. New to the API? Follow the Quickstart.