> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ionicfi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Use secret keys from trusted server environments.

Customer-facing API requests use secret API keys from trusted server environments.

<CodeGroup>
  ```ts TypeScript theme={null}
  import { Ionic } from "@ionicfi/sdk";

  const ionic = new Ionic({ token: process.env.IONIC_SECRET_KEY });

  const sessions = await ionic.checkout.sessions.list();
  ```

  ```bash curl theme={null}
  curl https://api.ionicfi.com/v1/checkout/sessions \
    -H "Authorization: Bearer sk_v1_test_..."
  ```
</CodeGroup>

Keep secret keys on your server. Do not place them in browsers, mobile apps, hosted checkout pages, or logs.

## Hosted checkout

Your backend creates checkout sessions and payment links. Ionic-hosted checkout handles buyer payment collection and confirmation without requiring you to send raw card data to the API.

Create checkout resources on your server, redirect the buyer, and retrieve the
completed session from your server before fulfilling the order.

## Retry behavior

Authentication identifies the caller. Idempotency identifies a retryable operation. For create and refund calls, send the same `Idempotency-Key` when retrying the same operation. See [Idempotency](/api-reference/idempotency) for the retry model.