> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chip-in.asia/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How CHIP Collect authenticates API requests and webhook callbacks.

CHIP Collect uses **two** distinct authentication mechanisms, and they
cover different concerns:

| Concern                                                       | Mechanism                                             |
| ------------------------------------------------------------- | ----------------------------------------------------- |
| Authenticating **outbound** API requests from your server     | Bearer API key (`Authorization: Bearer <secret_key>`) |
| Verifying **inbound** webhook and success callback deliveries | RSA signature in the `X-Signature` header             |

The two are deliberately separate so that webhook receivers don't need
access to your secret API key.

## 1. Authenticating API requests

Every request to the CHIP Collect API must include your **Secret Key** as
a bearer token in the `Authorization` header:

```
Authorization: Bearer <secret_key>
```

You can generate and manage your Secret Keys in the
[CHIP merchant portal](https://portal.chip-in.asia/collect/developers/api-keys).

### Example

```bash theme={null}
curl "https://gate.chip-in.asia/api/v1/purchases/" \
  -H "Authorization: Bearer <your_secret_key>"
```

### Brand ID

Some endpoints also require a **Brand ID** as part of the request body
or as a query parameter. You can find your Brand ID in the
[merchants portal](https://portal.chip-in.asia/collect/developers/brands).

### Test vs live keys

The merchant portal issues separate keys for **test mode** and **live
mode**. Test keys only work against test purchases and never move real
money. Always use a test key while integrating.

<Warning>
  Never expose your Secret Key in client-side code, mobile apps, or public
  repositories. The Secret Key can create real purchases and issue refunds.
</Warning>

## 2. Verifying webhook signatures

CHIP signs every webhook delivery and success callback with an
**asymmetric (public-key) signature** so the receiver can verify the
payload was sent by CHIP and not by an attacker.

See [Webhook signatures](/chip-collect/overview/webhook-signatures) for the
full algorithm, code samples, and how to obtain the public key.

## 3. CHIP Send (payouts) authentication

CHIP Send uses a different scheme: every request is signed with an
HMAC-SHA512 checksum derived from a per-request `epoch` and the API Key.
See the
[CHIP Send introduction](/chip-send/api-reference/introduction) for the
full algorithm.