sk_...).
- Send only
X-API-KEY: sk_...(noAuthorizationheader). The key needs the sameagent-checkouts.*scopes. Keep it secret — unlike theck_key, it is not safe in the browser. - Checkouts then run under a fixed service subject for your project — ideal for one agent that buys for itself.
- To create a checkout on behalf of a specific user, add the
x-crossmint-user-idheader. The subject is namespaced under your project (a server key can only address its own project’s subjects); omit it and it falls back to the shared service subject.
(project, subject), so resources created under one x-crossmint-user-id are only visible to that subject. Everything else — polling, responding to actions, reading the receipt — works exactly as in the quickstart.
