> ## Documentation Index
> Fetch the complete documentation index at: https://docs.grogov.us/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate requests with an API key or access token.

Every request to the Partner Payments API must include an `Authorization` header. You can send your API key with each request or exchange it for an access token.

## Use an API key

Send your API key on every request:

```text theme={null}
Authorization: ApiKey pc_<your-key>
```

The API also accepts the key without the `ApiKey` prefix:

```text theme={null}
Authorization: pc_<your-key>
```

API keys do not expire. Store your key securely and send it only from your backend.

## Use an access token

Call `POST /api/partner/v1/auth/token` with your API key in the `Authorization` header. The response includes an access token, a JWT that authenticates subsequent requests:

```text theme={null}
Authorization: Bearer <jwt>
```

Use an access token when you want to make requests without sending your API key each time. A card token represents card details and cannot authenticate requests.

### Token lifetime and renewal

Access tokens are valid for one hour, as indicated by `expiresIn: 3600`. When a token expires, exchange your API key for a new access token. There is no refresh token.

### Rotation and account deactivation

When GroGov rotates an API key, requests using the previous key fail immediately. Access tokens already issued from that key remain valid until they expire.

Deactivating your API account blocks requests using either credential on the next request. Contact GroGov support to rotate or revoke your API key or deactivate your account.

## Authentication failures

The following conditions return `401 Unauthorized`:

* A missing or malformed API key, including a key without the `pc_` prefix.
* An unknown or revoked API key.
* An inactive API account.
* A malformed or expired access token.

## Authentication examples

The following examples show the same `GET /api/partner/v1/payments` call using each authentication method:

<CodeGroup>
  ```bash cURL with an API key theme={null}
  curl "https://apistagepc.grogov.us/api/partner/v1/payments" \
    -H "Authorization: ApiKey pc_<your-sandbox-key>"
  ```

  ```bash cURL with an access token theme={null}
  curl "https://apistagepc.grogov.us/api/partner/v1/payments" \
    -H "Authorization: Bearer $JWT"
  ```
</CodeGroup>

<CodeGroup>
  ```ts Node.js with an API key theme={null}
  const res = await fetch(
    "https://apistagepc.grogov.us/api/partner/v1/payments",
    { headers: { Authorization: "ApiKey pc_<your-sandbox-key>" } },
  );
  const { data } = await res.json();
  ```

  ```ts Node.js with an access token theme={null}
  const res = await fetch(
    "https://apistagepc.grogov.us/api/partner/v1/payments",
    { headers: { Authorization: `Bearer ${jwt}` } },
  );
  const { data } = await res.json();
  ```
</CodeGroup>

See [Errors](/guides/errors) for the full error envelope returned on authentication failures and other error conditions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.