Authentication

Authenticated routes require two headers:

Header	Description
`X-Merchant-Key`	Public key id (for example `mk_live_…`)
`X-Merchant-Secret`	Secret shown once when the key was issued

Example


curl "https://staging-intelligent-70287b6a3284.herokuapp.com/ext/breeze/v1/wallet/balance" \
  -H "X-Merchant-Key: mk_live_your_key_id" \
  -H "X-Merchant-Secret: sk_live_your_secret"

Rules

Send both headers on every protected route.
Keys are scoped to your merchant profile.
Expired or wrong credentials return 401 with an error message.
Rotate keys through your account administrator when staff or vendors change.

GET /healthz does not require credentials.