API Authentication

Use an Organization API key on the server

Every Public API request needs an API key for the target Organization. Send it in the Authorization header and never call VietBilling directly from the browser.

const response = await fetch(
  `${process.env.VIETBILLING_API_URL}/public/v2/customers`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.VIETBILLING_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ external_id: user.id, email: user.email }),
  },
)

Handle failures deliberately

Never log the complete authentication header. For 401, check the key and environment; for 403, check its Organization or Customer Limit. Retry only network failures or 5xx responses with exponential backoff, not validation errors.

Rotate keys

Create a new key, update your secret store, and verify requests before revoking the old key. Keep staging and production keys separate.