Authentication

Pass Authorization: Bearer <secret_key>. Business and mode come from the key.

Prefix	Mode
`sk_test_…`	Test
`sk_live_…`	Live

curl https://api.puplar.com/customers \
  -H "Authorization: Bearer sk_test_your_key"

Missing/invalid key → 401. IP not on the key’s whitelist → 403. Do not put secret keys in browsers or repos.