Authentication and environments
Configure server credentials and keep sandbox activity separate from production.
Choose the environment
Use the sandbox for development and the production host only after merchant provisioning and launch approval. Environment Base URL Credential boundary Sandbox https://sandbox.nmi.com Sandbox merchant credentials Production https://secure.nmi.com Production merchant credentials
Payment API authentication
Send the private merchant API key as the complete Authorization header value. Do not prepend Bearer or ApiKey. REST payment bodies use JSON; Classic payment submissions use a different encoding. Authorization: <merchant-private-api-key> Content-Type: application/json
Keep keys in the right place
The browser payment component uses a public tokenization key. Private processing keys belong on your server. Recommended application controls: Store environment configuration and private secrets outside browser bundles and source control. Bind each merchant account to the correct environment and server credential. Redact authorization headers from request logs, traces and support exports. Test missing, revoked and wrong-environment credentials before rollout.
Deployment check
Treat changing the host and changing the credentials as one reviewed deployment. Confirm merchant ownership and feature activation before live requests. There is no Betterpay-specific API hostname or SDK package established by this portal. These payment-key instructions do not define Merchant Sign-Up API authentication. Do not reuse a payment credential contract across product families.