> ## Documentation Index
> Fetch the complete documentation index at: https://docs.northfond.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate server-to-server requests with scoped bearer API keys.

NorthFond uses secret bearer credentials. Keep keys on your server and never place them in browser code, mobile applications, source control, screenshots, or logs.

```bash theme={null}
curl https://payment.gideondevrel.xyz/api/v1/business/account \
  -H "Authorization: Bearer $NORTHFOND_API_KEY"
```

| Prefix     | Environment | Money movement            |
| ---------- | ----------- | ------------------------- |
| `nf_test_` | Sandbox     | Simulated                 |
| `nf_live_` | Live        | Real funds after approval |

## IP restrictions

Each key can allow up to ten exact IPv4 or IPv6 addresses. Requests from other addresses are rejected before endpoint processing.

## Rate limits

Responses include `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset`. Limited requests return `429` and a `Retry-After` header.

## Server environments

The API reference currently targets the public NorthFond backend at `https://payment.gideondevrel.xyz`. Sandbox and live access are separated by the credential prefix and the environment attached to the credential, not by putting a key in the URL.