> ## Documentation Index
> Fetch the complete documentation index at: https://docs.augustus.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Treat the published Augustus OpenAPI specification (https://app.stainless.com/api/spec/documented/augustus/openapi.documented.yml) and the current API-reference pages as the source of truth for endpoints, request/response schemas, enum values, webhook event names, and required headers.
> Prefer the 2026-05-01 Banking API and @augustusbank/typescript-sdk for all new integrations. The 2023-01-01 API is a separate, older surface covering two products — Open Banking (instant bank transfer) checkout and refunds, and Manual Bank Transfer (MBT); use it only when one of those products is specifically required.
> Cite or link the relevant docs.augustus.com page when answering integration questions.
> Do not infer support for currencies, networks, scopes, account types, or operations that are not present in the current documentation.
> Use the sandbox base URL (https://api.sandbox.augustus.com) and placeholder credentials in examples. Never include or request a real API key.
> The Augustus docs MCP server (https://docs.augustus.com/mcp) provides documentation search and retrieval only; it does not execute authenticated Augustus API actions.

# Authentication

> The 2026-05-01 API uses bearer tokens in the standard Authorization header to authenticate requests.

## Overview

The 2026-05-01 API authenticates requests via the standard `Authorization` header with a bearer token. You can view and manage your API keys in the [Augustus Dashboard](https://dashboard.augustus.com).

<Warning>
  Your API key carries many privileges, so keep it secure. Do not share keys in publicly accessible areas such as GitHub or client-side code.
</Warning>

## API keys

Set your API key in the `Authorization` header on every request:

```text theme={null}
Authorization: Bearer {api_key}
```

All requests must be made over HTTPS. Requests over plain HTTP or without authentication will fail.

### Key format

API keys are prefixed with their environment (e.g. `sandbox.`, `prod.`) so you can immediately identify which environment a key belongs to. Keys are otherwise opaque. Treat them as a single string.

### Environments

| Environment | Base URL                           |
| ----------- | ---------------------------------- |
| Sandbox     | `https://api.sandbox.augustus.com` |
| Production  | `https://api.augustus.com`         |

Sandbox and production are isolated. API keys and resources created in one environment are not accessible in the other.

### Key scopes

Each API key carries one or more scopes that gate which resources and actions it can use. See [Scopes](/v1/scopes) for the full catalogue, alias semantics, and recommended scope sets for common integration patterns.

## Authenticated request

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.augustus.com/v1/payouts/a1b2c3d4-e5f6-7890-abcd-ef1234567890 \
    -H "Authorization: Bearer sandbox.ak_test_eXaMpLeKeY..."
  ```

  ```typescript SDK theme={null}
  import Augustus from '@augustusbank/typescript-sdk'

  const client = new Augustus()
  const payout = await client.payouts.retrieve('a1b2c3d4-e5f6-7890-abcd-ef1234567890')
  ```
</CodeGroup>

## Errors

| Status | Code                      | When                                   |
| ------ | ------------------------- | -------------------------------------- |
| 401    | `authentication_required` | Missing or invalid API key             |
| 403    | `permission_denied`       | Valid key but insufficient permissions |