Every request to the Olympus public API is authenticated with a key in the Authorization: Bearer header. Keys are scoped, so each one can only call the endpoints it was created for.
- olp_test_… keys are sandbox keys. Every call works as it does live, but checkout opens a page where you choose the outcome, and no real money or bank account is involved.
- olp_live_… keys move real money, so money-moving endpoints need your verification to be complete.
Sandbox and live data are always separate. Write requests accept an Idempotency-Key so a retried request returns the original result.
Create keys in the merchant dashboard. The developer portal has the reference, and the OpenAPI spec is machine-readable.