Authentication

Ingest uses X-Fiscal402-Key on the server. Receipt verification does not use the key.

Where the key goes

Production ingest authenticates with X-Fiscal402-Key. Put the key in FISCAL402_API_KEY on the server. Never send it from a browser, a mobile app, or an agent prompt.

.env

FISCAL402_API_KEY=$FISCAL402_API_KEY
FISCAL402_ORIGIN=https://api.fiscal402.com

Header

http

POST https://api.fiscal402.com/settlements
X-Fiscal402-Key: $FISCAL402_API_KEY
Content-Type: application/json

Scope

The key identifies the merchant account, including seller establishment used for EU VAT.
Seller legal name and VAT number are account data, not fields on POST /settlements.
Receipt verification does not use the ingest key. JWKS is public.

Rotation

Request a replacement key through the production pilot channel. Do not paste keys into GitHub issues, chat, or screenshots. If a key leaked, say so and stop using it.

Environments

There is no separate public sandbox origin. POST /v1/compliance/evaluate classifies without writing a production settlement. Production ingest is https://api.fiscal402.com.