> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jaza.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Secret keys on the server, publishable keys in the app, and short-lived top-up JWTs.

Jaza uses two long-lived keys plus a short-lived top-up token.

## Keys

| Key         | Prefix (sandbox / live)         | Where                                |
| ----------- | ------------------------------- | ------------------------------------ |
| Secret      | `jz_test_sk_…` / `jz_live_sk_…` | Server only — `@jazadev/node`        |
| Publishable | `jz_test_pk_…` / `jz_live_pk_…` | Mobile app — `@jazadev/react-native` |

```ts theme={null}
import { Jaza } from '@jazadev/node';

const jaza = new Jaza({
  secretKey: process.env.JAZA_SECRET_KEY!,
  publicKey: process.env.JAZA_PUBLIC_KEY!,
});
```

<Warning>
  Never embed the secret key in a mobile app, web frontend, or public repository.
</Warning>

## Top-up JWT

`jaza.topUp({ customerId })` returns a short-lived JWT. Your Expo app passes it to `JazaTopUpButton` via `onRequestToken`. The React Native SDK sends:

* `X-Jaza-Public-Key: <publishable key>`
* `Authorization: Bearer <top-up JWT>`

## Environments

Sandbox and live are isolated (keys, wallets, top-ups). Use test keys until the flow is solid, then switch to live keys from the dashboard.

## Next steps

* [Quickstart](/quickstart) · [Top up](/guides/top-up) · [Node SDK](/sdks/node)