Authentication

Ingest uses X-Fiscal402-Key on the server. Receipt verification does not use the key.

Where the key goes

Production ingest authenticates with X-Fiscal402-Key. Put the merchant-scoped key in FISCAL402_MERCHANT_KEY on the server. Keys use the f402m_ prefix. Never send it from a browser, a mobile app, or an agent prompt.

.env

FISCAL402_MERCHANT_KEY=f402m_your_key_here
FISCAL402_ORIGIN=https://api.fiscal402.com

Header

http

POST https://api.fiscal402.com/settlements
X-Fiscal402-Key: f402m_your_key_here
Content-Type: application/json

Scope

The key identifies the merchant account, including seller establishment used for EU VAT.
Seller legal name and VAT number are account data, not fields on POST /settlements.
Receipt verification does not use the ingest key. JWKS is public.

Rotation

Request a replacement key through the production pilot channel. Do not paste keys into GitHub issues, chat, or screenshots. If a key leaked, say so and stop using it.

Environments

There is no separate public sandbox origin. POST /v1/compliance/evaluate classifies without writing a production settlement. Production ingest is https://api.fiscal402.com.