Skip to main content
Ionic authenticates every API request with a secret key sent as a bearer token. Create keys in the Dashboard, keep secret keys on your server, and give the browser a publishable key only for Ionic Blocks.

​
Get your keys

1

Open API keys in the Dashboard

Sign in to the Dashboard and open Developers → API keys. Platforms create platform keys in Connect → API keys.
2

Create a test secret key

Test secret keys start with sk_v1_test_ and move no money.
3

Store the key on your server

Keep the key in your secret manager or in an environment variable such as IONIC_SECRET_KEY.

​
Authenticate a request

Send the secret key in the Authorization header as a bearer token. The server SDK sets the header from token.
A missing, invalid, or revoked key returns 401. A key without the permission an operation needs returns 403. See Errors.

​
Choose a key

A restricted key keeps the permissions selected when you create it. Standard secret keys receive permissions that Ionic adds to the standard policy. See Choosing key permissions.

​
Keep secret keys on your server

  • Call Ionic from your backend. Your frontend calls your server, and your server calls Ionic.
  • Keep secret keys out of browsers, mobile apps, source control, and logs.
  • Send the browser a publishable key and the client secret for one intent. See Browser credentials.
  • Rotate a key that may be exposed, and revoke keys you no longer use.

​
Test and live keys

The mode in a key’s prefix selects the dataset each request reads and writes. Test and live data are fully isolated, so keep test keys and live keys in separate configuration. Switch to live keys when you go live.

​
Keys for platforms

A platform authenticates with a platform secret key from Connect → API keys and selects one connected account per request with the Ionic-Account header or the server SDK’s account option:
Choose the merchant on your server after authenticating and authorizing your own user. See How Connect works.

​
What’s next

How Ionic works

Follow a payment from creation to completion, and see how its objects connect.

Authentication reference

Look up browser credentials, key permissions, and requests for connected accounts.

Idempotency

Retry a request without repeating its effect.

Test cards

Pay with test card numbers in test mode.