> ## Documentation Index
> Fetch the complete documentation index at: https://docs.copby.digitalcop.shop/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How partners authenticate to the Integrations API.

Every Integrations route requires an API key that COP By issues to your integration.

```http theme={null}
Authorization: Bearer copby_live_pk_<public_id>.<secret>
```

<Warning>
  Keep the key on your server. Partners must not put it in MiniPay. Never expose `BRIDGE_API_KEY`.
</Warning>

## MiniPay first-party

The COP By miniapp calls `/api/breb/*` (same bodies as `/api/integrations/breb/*`) with **no Bearer key**. Those aliases pin `integration_id` to `copby` and require `userAddress` on list, get, and confirm so one wallet cannot read another.

Use `/api/integrations/breb/*` from a partner backend. Use `/api/breb/*` from the miniapp.

## Playground

1. Open any endpoint in **API reference**.
2. Paste the key in the **Authorization** field. You can omit the `Bearer ` prefix; Mintlify adds it.
3. Pick the **Local** server (`http://localhost:3000`) while `pnpm --filter web dev` is running.

## Isolation

The key maps to one `integration_id`. List and confirm routes ignore any other integration id in the query or body. A payout created by partner A is not visible to partner B.

## Errors

| Status | `errorCode` | Meaning                             |
| ------ | ----------- | ----------------------------------- |
| 401    | —           | Missing or invalid key              |
| 403    | —           | Origin not allowlisted for that key |