> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orchard.africa/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate Orchard SDK requests with keys and tokens

> Configure the Orchard SDK client with your API URL, API key, and a per-user session token, and understand the headers sent on every API request.

Every Orchard SDK request carries two credentials: your organization's API key and a session token for the current user. You pass both once when you create the client, and the SDK adds them to every call.

## Client configuration

```js theme={null}
const orchard = new Orchard({
  apiUrl: "https://<your-orchard-api-url>",
  sessionToken: userSessionToken,
  apiKey: "<your-orchard-api-key>",
});
```

<ParamField path="apiUrl" type="string" required>
  Base URL of the Orchard API. A trailing slash is removed automatically.
</ParamField>

<ParamField path="sessionToken" type="string" required>
  Token identifying the signed-in user. Sent as a bearer token.
</ParamField>

<ParamField path="apiKey" type="string" required>
  Your Orchard API key. Sent in the `X-Orchard-Key` header.
</ParamField>

## Request headers

The client sends these headers on every request:

| Header | Value |
| - | - |
| `Authorization` | `Bearer <sessionToken>` |
| `X-Orchard-Key` | `<apiKey>` |
| `Accept` | `application/json` |
| `Content-Type` | `application/json` |

## Getting credentials

Contact the Orchard team to get your API key and the API base URL for each environment. Ask how session tokens are issued for your integration, since the token identifies the end user making the investment.

<Warning>
  The SDK runs in the browser, so any value passed to the client is visible to the user. Keep long-lived secrets on your server and issue short-lived session tokens to the browser where possible.
</Warning>

## Authentication errors

If a request fails, the client throws an `Error` whose message is the `message` field from the API response, or `Orchard API request failed.` when none is returned.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.