Authorization

Obtaining an API Token

To obtain an API token, you must first create a merchant account on the Flow Payments platform.

Steps to Generate a Token

1. Log in to your Flow Payments dashboard
2. Navigate to API → API Keys
3. Click Generate New Key
4. Give your key a descriptive name (e.g., "Production API", "Test Server")
5. Copy immediately the generated token - it will not be displayed again

!CAUTION Keep your API tokens secure. Never share them publicly and do not commit them to your source code. If a token is compromised, revoke it immediately and generate a new one.

Using the Token in Requests

Include your API token in the Authorization header of each request using the Bearer scheme:

Authorization: Bearer your_api_token_here

Example with cURL

curl -X GET https://api.flow-payments.com/api/balances \
  -H "Authorization: Bearer sk_live_abc123xyz789..." \
  -H "Accept: application/json"

Example with JavaScript (fetch)

const response = await fetch('https://api.flow-payments.com/api/balances', {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer sk_live_abc123xyz789...',
    'Accept': 'application/json',
    'Content-Type': 'application/json'
  }
});

const data = await response.json();
console.log(data);

Example with PHP

<?php

$token = 'sk_live_abc123xyz789...';

$ch = curl_init('https://api.flow-payments.com/api/balances');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ' . $token,
    'Accept: application/json',
    'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$data = json_decode($response, true);

curl_close($ch);

Authentication Errors

401 Unauthorized

If your token is missing, invalid, or expired, you will receive a 401 Unauthorized response:

{
  "message": "Unauthenticated."
}

Possible solutions:

• Verify that the Authorization header is present
• Ensure the token starts with Bearer
• Check that the token has not been revoked
• Generate a new token if necessary

403 Forbidden

If you attempt to access a resource that does not belong to you:

{
  "message": "This action is unauthorized."
}

Security Best Practices

!IMPORTANT Follow these recommendations to secure your API tokens:

1. Environment Variables: Store your tokens in environment variables, never hardcoded in your code

   # .env
   FLOW_PAYMENTS_API_TOKEN=sk_live_abc123xyz789...
   

2. Different Tokens per Environment: Use separate tokens for development, staging, and production
3. Regular Rotation: Change your tokens periodically to minimize risks
4. HTTPS Only: Always use HTTPS for all API requests

Token Revocation

If you believe a token has been compromised:

1. Log in to your dashboard
2. Navigate to API → API Keys
3. Find the token in question
4. Click Revoke
5. Generate a new token
6. Update your application with the new token

Rate Limiting

The API implements rate limiting at 30 requests per minute per API token to ensure service stability.

If you exceed the rate limit, you will receive an HTTP 429 Too Many Requests response. Please reduce the frequency of your requests.

!TIP If you need a higher rate limit for your use case, please contact our support team to discuss your requirements.