Set default payment method
Authentication
Bearer authentication of the form Bearer <token>, where token is your auth token.
Server-side API key (drzl_live_ prefix), least-privilege scoped. Keep it secret — never ship it to a browser or SPA. An alternative to a session JWT (HTTPBearer) on the developer surface. See docs/api/cors-and-auth.md.
Path parameters
Headers
Client-supplied key that makes this unsafe mutation retry-safe. Reusing a key with the same request replays the original result (the response then carries Idempotency-Replayed: true); reusing it with a different request returns 409. Optional but strongly recommended so a network retry cannot double-apply.

