Authentication
API credentials and access control.
Use your server-side Basic Auth username and password, or the API key given once when live access is enabled.
Authorization: Basic BASE64_USERNAME_COLON_PASSWORDor
Authorization: Bearer et_live_YOUR_KEYThe dashboard uses a separate password plus email verification code. The backend also exposes /v1/auth/password-reset/request and /v1/auth/password-reset/confirm for forgotten passwords.
Access is controlled per merchant, country (bj, tg) and operator (mtn_bj, moov_bj, moov_tg, togocel_tg). Collection and read rights are separate. A country right and its operator right must both be enabled. Merchant credentials cannot access /v1/admin/*.
Never put API secrets in NEXT_PUBLIC_* variables or frontend code. A 401 means authentication failed; a 403 means the account or operation is not authorized.