API Keys

Fintoc uses API Keys to authenticate your interactions with the API. If you call the API without your key, or if you use an incorrect one, Fintoc returns an error. This page explains the key types and environments, how to manage and rotate keys, and how to restrict access by IP address.

Every Fintoc account has two key pairs: one for test mode and one for live mode. Each resource lives in either the test or live environment, and a key for one environment cannot access resources in the other.

Each pair has two types of API Key: public and secret.

• Use the Public Key only to identify your account inside Fintoc. It is not secret, and you use it to integrate the Widget.
• Use the Secret Key to query the Fintoc API. As its name suggests, it is secret, and you should only use it from your application's backend.

Upon creation, each account has a total of 4 keys: a Public Key and a Secret Key for test mode, and a Public Key and a Secret Key for live mode (the production environment).

Getting your API Keys

🚧

You can access your secret API Key for live mode only once

You can copy and see your API Key only when you activate or rotate it. Store the key securely in your backend.

You can activate and manage your API Keys from your Dashboard.

Rotating your API Keys

We recommend rotating (changing) your API Keys at least once per year to ensure they remain secret. You can rotate your API Keys from your Dashboard.

IP Restrictions

You can configure IP Restrictions so that Fintoc accepts requests only from the IP addresses you list and rejects all others.

To configure these restrictions:

1. Go to dashboard.fintoc.com.
2. Navigate to the API Keys tab on the sidebar.
3. If your organization has products with IP Restrictions enabled, the IP Restrictions section appears. Toggle on the IP Restrictions option.
4. Click the "IP Restrictions" button and enter the individual IP addresses or CIDR blocks from which you make requests to the Fintoc API.

What are CIDR blocks?

CIDR (Classless Inter-Domain Routing) blocks define a range of IP addresses. Instead of listing every individual IP address, CIDR blocks let you specify a group of addresses compactly. For example:

192.168.1.0/24 represents all IP addresses from 192.168.1.0 to 192.168.1.255.

If you're unsure how to determine your CIDR block, consult your network administrator or technical team. They can help you identify the correct range of IP addresses to use.

🚧

Be sure to add IP addresses when you turn on the IP Restrictions feature

If you turn on the IP Restrictions feature but add no IP addresses, Fintoc rejects every request.