Skip to main content
CHIP Collect uses two distinct authentication mechanisms, and they cover different concerns: The two are deliberately separate so that webhook receivers don’t need access to your secret API key.

​
1. Authenticating API requests

Every request to the CHIP Collect API must include your Secret Key as a bearer token in the Authorization header:
You can generate and manage your Secret Keys in the CHIP merchant portal.

​
Example

​
Brand ID

Some endpoints also require a Brand ID as part of the request body or as a query parameter. You can find your Brand ID in the merchants portal.

​
Test vs live keys

The merchant portal issues separate keys for test mode and live mode. Test keys only work against test purchases and never move real money. Always use a test key while integrating.
Never expose your Secret Key in client-side code, mobile apps, or public repositories. The Secret Key can create real purchases and issue refunds.

​
2. Verifying webhook signatures

CHIP signs every webhook delivery and success callback with an asymmetric (public-key) signature so the receiver can verify the payload was sent by CHIP and not by an attacker. See Webhook signatures for the full algorithm, code samples, and how to obtain the public key.

​
3. CHIP Send (payouts) authentication

CHIP Send uses a different scheme: every request is signed with an HMAC-SHA512 checksum derived from a per-request epoch and the API Key. See the CHIP Send introduction for the full algorithm.