> ## Documentation Index
> Fetch the complete documentation index at: https://dev.moonpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using the API

> Base URL, API keys, and which widget endpoints need which authentication scheme

## Base URL

```text theme={null}
https://api.moonpay.com
```

Test and live environments use the same base URL. The key prefix determines the environment.

## Availability

Not every endpoint in this reference is available to every account:

| Tier                | Meaning                                                       | Endpoints                                                                                    |
| ------------------- | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Self-serve          | Works with your API keys today                                | Currencies, quotes, limits, countries, transactions, customers, payment methods, DeFi tokens |
| Requires enablement | Returns `403` until enabled for your account. Contact support | Virtual accounts                                                                             |

## Authentication

The widget API uses two authentication schemes. Every endpoint page in this reference declares the scheme it needs in its **Authorizations** section.

### API keys

You have two kinds of API key, both found on the [API keys page](https://dashboard.moonpay.com/developers/api-keys) of your MoonPay dashboard:

| Key             | Prefixes               | Where it can live             | Used as                                      |
| --------------- | ---------------------- | ----------------------------- | -------------------------------------------- |
| Publishable key | `pk_test_`, `pk_live_` | Client-side code, widget URLs | `apiKey` query parameter                     |
| Secret key      | `sk_test_`, `sk_live_` | **Server-side only**          | `Authorization: Api-Key <secret key>` header |

`_test_` keys operate against the sandbox, `_live_` keys against production. Test and live data are fully separate.

<Warning>
  Never expose a secret key in client-side code, mobile apps, or version
  control. Anyone holding it can read your customers' transaction data.
</Warning>

### Publishable key (query parameter)

Currencies, quotes, limits, network fees, and single-transaction lookups authenticate with your publishable key as the `apiKey` query parameter:

```bash theme={null}
curl "https://api.moonpay.com/v3/currencies/btc/buy_quote?apiKey=pk_test_key&baseCurrencyAmount=100&baseCurrencyCode=usd"
```

`GET /v3/countries` works without a key; passing one tailors availability to your account's configuration.

### Secret key (Authorization header)

The [server-to-server endpoints](/api-reference/widget/getbuytransactions) and `GET /payments/v1/payment-method-config` authenticate with your secret key in the `Authorization` header, using the `Api-Key` prefix:

<CodeGroup>
  ```bash curl theme={null}
  curl "https://api.moonpay.com/v1/transactions" \
    --header "Authorization: Api-Key sk_test_key"
  ```

  ```typescript fetch theme={null}
  const response = await fetch("https://api.moonpay.com/v1/transactions", {
    headers: { Authorization: "Api-Key sk_test_key" },
  });
  ```
</CodeGroup>

### URL signing

Widget URLs that carry sensitive query parameters require a `signature` parameter, computed with your secret key. This is separate from API authentication. See [URL signing](/widget/on-ramp/customization/url-signing).