> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ionicfi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with API keys

> Get your API keys, authenticate requests from your server, and choose the right key for each part of your integration.

Ionic authenticates every API request with a secret key sent as a bearer token.
Create keys in the Dashboard, keep secret keys on your server, and give the
browser a publishable key only for Ionic Blocks.

## Get your keys

<Steps>
  <Step title="Open API keys in the Dashboard">
    Sign in to the [Dashboard](https://app.ionicfi.com) and open
    **Developers → API keys**. Platforms create platform keys in
    **Connect → API keys**.
  </Step>

  <Step title="Create a test secret key">
    Test secret keys start with `sk_v1_test_` and move no money.
  </Step>

  <Step title="Store the key on your server">
    Keep the key in your secret manager or in an environment variable such as
    `IONIC_SECRET_KEY`.
  </Step>
</Steps>

## Authenticate a request

Send the secret key in the `Authorization` header as a bearer token. The server
SDK sets the header from `token`.

<CodeGroup>
  ```ts TypeScript theme={null}
  import { Ionic } from "@ionicfi/sdk";

  const ionic = new Ionic({ token: process.env.IONIC_SECRET_KEY });

  const sessions = await ionic.checkout.sessions.list();
  ```

  ```bash curl theme={null}
  curl https://api.ionicfi.com/v1/checkout/sessions \
    -H "Authorization: Bearer $IONIC_SECRET_KEY"
  ```
</CodeGroup>

A missing, invalid, or revoked key returns `401`. A key without the permission
an operation needs returns `403`. See [Errors](/api-reference/errors).

## Choose a key

| Key | Prefix | Runs on | Use it for |
| - | - | - | - |
| Secret key | `sk_v1_test_`, `sk_v1_live_` | Your server | API requests under Ionic's standard permission policy |
| Restricted secret key | `rk_v1_test_`, `rk_v1_live_` | Your server | API requests limited to the permissions you select |
| Publishable key | `pk_v1_test_`, `pk_v1_live_` | Your customer's browser | Mounting Ionic Blocks with one intent's client secret |

A restricted key keeps the permissions selected when you create it. Standard
secret keys receive permissions that Ionic adds to the standard policy. See
[Choosing key permissions](/api-reference/authentication#choosing-key-permissions).

## Keep secret keys on your server

* Call Ionic from your backend. Your frontend calls your server, and your server
  calls Ionic.
* Keep secret keys out of browsers, mobile apps, source control, and logs.
* Send the browser a publishable key and the client secret for one intent. See
  [Browser credentials](/api-reference/authentication#browser-credentials).
* Rotate a key that may be exposed, and revoke keys you no longer use.

## Test and live keys

The mode in a key's prefix selects the dataset each request reads and writes.
Test and live data are fully isolated, so keep test keys and live keys in
separate configuration. Switch to live keys when you
[go live](/guides/going-live).

## Keys for platforms

A platform authenticates with a platform secret key from **Connect → API keys**
and selects one connected account per request with the `Ionic-Account` header
or the server SDK's `account` option:

```http theme={null}
Ionic-Account: mer_01JEXAMPLE7A5P9D3F8K2N4Q
```

Choose the merchant on your server after authenticating and authorizing your own
user. See [How Connect works](/guides/connect-overview).

## What's next

<CardGroup cols={2}>
  <Card title="How Ionic works" icon="lightbulb" href="/concepts/key-concepts">
    Follow a payment from creation to completion, and see how its objects connect.
  </Card>

  <Card title="Authentication reference" icon="key" href="/api-reference/authentication">
    Look up browser credentials, key permissions, and requests for connected accounts.
  </Card>

  <Card title="Idempotency" icon="repeat" href="/api-reference/idempotency">
    Retry a request without repeating its effect.
  </Card>

  <Card title="Test cards" icon="credit-card" href="/guides/test-cards">
    Pay with test card numbers in test mode.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.