One bearer token, and it is the one you already have.

Send Authorization: Bearer <token> on every request. The token is a GoTrue JWT — the same credential the merchant portal signs in with. There is no separate API key to provision.

The token carries your account (app_metadata.sender_id) and your role. Both are read from the verified token, never from anything in the request, which is why no endpoint takes a sender_id parameter: supplying one changes nothing.

🔴 The API keys on Settings ▸ Webhooks & APIs are not a credential for this API. They are accepted today only by the tracking API, and their secret is not yet verified by anything. Do not build against them here.

A missing, expired or unverifiable token is 401 {"error":"Authentication required"} or {"error":"Invalid or expired token","code":"…"}.