Skip to main content

Send your key

Put the key in the x-api-key header. Authorization: Bearer fpay_… works too, if your HTTP client prefers it. A request without a valid key gets 401.

Test and live keys

A business has one active key of each kind, and both work at once, so you can keep testing while you’re live. Data doesn’t cross over: a test key can’t see live payments, and each mode has its own webhook URL and signing secret. Every response says which mode it came from in livemode.

Get, roll and revoke keys

Email support@flipeet.io from your business account’s email address.
  • Get a key. Ask for a sandbox key to start, and a live key when you’re ready to go live.
  • Roll a key. We issue a new key for that mode and the old one stops working at once. We store only a hash of each key, so we can’t send an old key again.
  • Revoke a key. We stop it immediately, for example if it leaked.
Rolling a live key stops the old one straight away, so tell us when you’re ready to switch and have the new key on your server first. Webhook signing secrets are separate, so rolling a key doesn’t change how you verify webhooks.

Keep keys safe

  • Keep keys on your server, in an environment variable or a secrets manager.
  • Never put a key in a mobile app, website code or a public repository.
  • Use the sandbox key for development and staging, and the live key only in production.
  • If a key may have leaked, email us straight away to revoke it and issue a new one.