Skip to main content
Two portals, two audiences. dashboard.prava.space is the developer console: sign up, create API keys, switch to production. pay.prava.space is the Prava Pay dashboard for agent owners: approve agent links, enroll cards, set spending controls. A developer integrating the API only needs the console; an agent owner only needs the Prava Pay dashboard.

​
Authentication Model

Prava uses a dual-key system with two distinct authentication modes depending on where the request originates.

​
Merchant Secret Key (Server-to-Server)

Used for backend operations like creating sessions and listing cards.
  • Include the key as a Bearer token: Authorization: Bearer sk_test_xxx or Authorization: Bearer sk_live_xxx
  • Never expose secret keys in client-side code, version control, or logs.
  • Rotate keys immediately if compromised.

​
Publishable Key (Client-Side)

Used to initialize the SDK in the browser.
  • Passed during SDK initialization: new PravaSDK({ publishableKey: 'pk_test_xxx' })
  • Safe to include in frontend code — scoped to client-side operations only.

​
Session-Based Auth

After creating a session via the backend (POST /v1/sessions), the returned session_token authenticates all subsequent operations within that session (card collection, transactions, FIDO authentication; FIDO is the standard behind passkeys). Session tokens are:
  • Short-lived: expire after a configured duration.
  • Single-use: tied to a specific merchant, customer, and order.
  • Revocable: can be revoked via POST /v1/sessions/:id/revoke.

​
Environments

Sandbox is self-serve: start building immediately. Switching to production is done from the Prava Dashboard and may require some additional verification; contact support@prava.space when you’re ready to go live.

​
Response Headers

Every API response includes an X-Response-ID header — a unique identifier for that request. Include this ID when contacting support to help us trace issues quickly.

​
Webhooks

Webhook event delivery is coming soon. Today you can already configure a webhook_url on your merchant account and you receive a webhook_secret (whsec_…) at merchant creation. Keep it safe; it will be used to verify event signatures once delivery ships. Until then, poll Get Payment Result for payment outcomes; the API journey is fully synchronous and complete without webhooks.