Client Secret
Authenticate with a server-minted, per-object client secret used as a Bearer token.
Covers the charge-intent client_secret (ci_<id>_secret_…), onboarding-session tokens (onb_sess_…), and the checkout token (chk_sess_…).