> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flipeet.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Every request carries one of your secret keys. The key decides which business is calling, and whether it's a test or real.

## Send your key

Put the key in the `x-api-key` header. `Authorization: Bearer fpay_…` works too, if your HTTP client prefers it. A request without a valid key gets `401`.

```bash cURL theme={null}
curl "https://api.pay.flipeet.io/api/v1/merchant/balance" \
  -H "x-api-key: $FLIPEET_SECRET_KEY"
```

```javascript Node.js theme={null}
const response = await fetch("https://api.pay.flipeet.io/api/v1/merchant/balance", {
  method: "GET",
  headers: {
    "x-api-key": process.env.FLIPEET_SECRET_KEY,
  },
});
const { data } = await response.json();
```

```python Python theme={null}
import os
import requests

response = requests.get(
    "https://api.pay.flipeet.io/api/v1/merchant/balance",
    headers={"x-api-key": os.environ["FLIPEET_SECRET_KEY"]},
)
data = response.json()["data"]
```

## Test and live keys

| Prefix | Mode | What happens |
| - | - | - |
| `fpay_test_` | Sandbox | Nothing reaches a bank or a blockchain. You choose each payment's outcome. |
| `fpay_live_` | Live | Real customers, real money, real payouts. |

A business has one active key of each kind, and both work at once, so you can keep testing while you're live. Data doesn't cross over: a test key can't see live payments, and each mode has its own webhook URL and signing secret. Every response says which mode it came from in `livemode`.

## Get, roll and revoke keys

Email [support@flipeet.io](mailto:support@flipeet.io) from your business account's email address.

* **Get a key.** Ask for a sandbox key to start, and a live key when you're ready to [go live](https://docs.flipeet.io/going-live.md).
* **Roll a key.** We issue a new key for that mode and the old one stops working at once. We store only a hash of each key, so we can't send an old key again.
* **Revoke a key.** We stop it immediately, for example if it leaked.

> [!WARNING]
>
> Rolling a live key stops the old one straight away, so tell us when you're ready to switch and have the new key on your server first. Webhook signing secrets are separate, so rolling a key doesn't change how you [verify webhooks](https://docs.flipeet.io/webhooks.md#verify-signatures).

## Keep keys safe

* Keep keys on your server, in an environment variable or a secrets manager.
* Never put a key in a mobile app, website code or a public repository.
* Use the sandbox key for development and staging, and the live key only in production.
* If a key may have leaked, email us straight away to revoke it and issue a new one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.