Requests that send
Content-Type: application/json bodies also need that header, as usual.
Example request
Finding your keys
Your keys live under Developers → Configuration in the dashboard. Each app has a separate sandbox and live pair, and you can regenerate either at any time.
The Configuration screen, where each app's keys are listed
The key you pass in
Authorization is the private key for the environment you are hitting. A sandbox key will not authenticate against api.trypila.co, and vice versa.Setting it up in Postman
Add both values as headers on the request —Authorization with your private key and AppId with the application ID.
Authorization and AppId headers set on a Postman request
Base URLs
Every request must include a base URL, and every request must be made over HTTPS.
See Environments for what differs between the two.
Keeping keys safe
Read keys from environment variables or a secrets manager at runtime.
Call Pila from your backend only. A key shipped in a mobile app or browser bundle is a key that has leaked.
Use separate apps for separate products or environments so you can rotate one without taking everything down.
Regenerate immediately from Developers → Configuration if a key is ever exposed — in a commit, a log, a screenshot or a support ticket.
Troubleshooting
It works in sandbox but not in live
It works in sandbox but not in live
You are probably still sending the sandbox key, or your account has not been verified for live access yet. Both the base URL and the key have to change together.
It stopped working suddenly
It stopped working suddenly
Someone may have regenerated the key from the dashboard. Copy the current value from Developers → Configuration and redeploy.