# Authentication

> Public and secret keys of the Fina Pay connector, rate limits and key rotation.

Each Fina Pay **connection** (one per integration, under your business → Connectors → Fina Pay) has a key pair:

| Key | Format | Where | Used for |
| --- | --- | --- | --- |
| Secret key | `sk_live_…` | Server only | `Authorization: Bearer sk_live_…` on every charge, payout and recipient endpoint |
| Public key | `pk_live_…` | Safe in a browser | Public lookup `GET /charges?token=…&public_key=…` for your own payment page |
| IPN secret | You choose it | Server only | Verifying the `x-fina-sig` header of webhooks |

**Header — HTTP**

```http
Authorization: Bearer sk_live_…
```

- Fina stores only a hash of the secret key: it is shown once. Regenerating it invalidates the old one immediately.
- Pausing or deleting the connection makes its keys answer `401 unauthorized`.
- Rate limit: **60 requests per minute per connection**. Above that you get `429 rate_limited`; wait and retry with backoff.
- Each connection books paid charges into the income account and category you chose, so use one connection per sales channel if you want separate reporting.

Source: https://fina.do/developers#authentication