# Authentication

Configure Partner credentials and handle SDK errors in trusted server code.

Documented SDK: @minmoto/sdk 0.3.0

The public SDK accepts `partnerId` and `apiKey`. It sends the key using
`X-API-Key` and scopes Partner resources to the configured Partner.
It does not expose the internal SDK's bearer-token or token-provider helpers.

Keep API keys in server-side secrets. Never place them in browser bundles,
mobile apps, public environment variables, logs, or prompts sent to AI tools.
Grant each key only the capabilities its integration needs.

## Handle errors

```ts
import { MinmoClient, MinmoSdkError } from "@minmoto/sdk";

const minmo = new MinmoClient({
  partnerId: process.env.MINMO_PARTNER_ID!,
  apiKey: process.env.MINMO_API_KEY!,
});

try {
  await minmo.account.get();
} catch (error) {
  if (error instanceof MinmoSdkError) {
    console.error({
      code: error.code,
      status: error.status,
      requestId: error.requestId,
      retryable: error.retryable,
    });
  }
  throw error;
}
```

Use `retryable` as an input to a bounded retry policy. Preserve idempotency
keys when retrying operations that create payable resources or move money.
Do not blindly retry an operation whose outcome is unknown; reconcile its state.