Skip to main content
Authenticated request
Fintoc uses API keys to authenticate requests. The API keys you use to make requests are called secret keys. Secret keys have broad privileges, so keep them safe. Don’t share secret keys in public repositories or client-side code. Include a secret key in the Authorization header with every API request:
Authentication
Send every API request over HTTPS. Requests over plain HTTP fail. Unauthenticated requests also fail.

​
API version

Fintoc identifies API versions by release date. Fintoc pins your account to the version current on your first API request and keeps it there until you upgrade. New versions do not affect your integration unless you upgrade. To override the version for a single request, send the Fintoc-Version header:
API version
The v2 Checkout Session, Payment Intent, and Setup Intent endpoints require version 2026-02-01 or later. If your account is pinned to an earlier version, send the Fintoc-Version header on these endpoint requests. This lets you test them without affecting the rest of your integration.