Skip to main content
The Flowlix API authenticates every request with a secret API key sent as a Bearer token:
Requests without a valid key return 401 Unauthorized with error.code: "invalid_api_key". See Errors.

​
API keys

You manage API keys in the Developers section of the Merchant Portal. Each key belongs to exactly one merchant account and one mode: Test and live mode share the same API host — the mode is determined entirely by the key you send. Objects created in one mode are invisible to keys of the other mode, and every API object carries a livemode boolean so you can always tell them apart.

​
Key security

Secret keys grant full access to your merchant account: creating payments, reading payment data, and issuing refunds. Treat them like passwords.
  • Call the API only from your backend. Never expose secret keys in browsers, mobile apps, or client-side code.
  • Store keys in a secrets manager or environment variables, never in source control.
  • Rotate keys from the Merchant Portal if you suspect a leak. Revoked keys stop working immediately and requests with them return 401.

​
Common authentication errors