Skip to main content
Fintoc uses API keys to authenticate your API requests. Fintoc returns an error if a request has no key or an incorrect key. This page explains key types and environments, key management and rotation, and IP address restrictions. Every Fintoc account has two key pairs: one for test mode and one for live mode. Each resource belongs to one environment. A key cannot access resources in the other environment. Each pair contains two types of API key:
  • Use the public key to identify your account in Fintoc and integrate the Widget. The public key is not secret.
  • Use the secret key to query the Fintoc API. Keep your secret key private and use it only from your application’s backend.
When you create an account, Fintoc provides four keys: a public key and a secret key for test mode, and a public key and a secret key for live mode.

​
Get your API keys

You can access your secret API key for live mode only onceYou can view and copy a secret API key only when you activate or rotate the key. Store secret keys securely in your backend.
You can activate and manage your API keys from the Dashboard.

​
Rotate and revoke your live secret keys

We recommend rotating your live secret keys at least once a year. You can manage them from the API keys page in the Dashboard. To rotate a live secret key without downtime:
  1. Click Create secret key to create a new live secret key.
  2. Update your backend to use the new key.
  3. Open the three-dot menu next to the old key and click Revoke.
Revoking a key takes effect immediately and cannot be undone. Any application that still uses the revoked key stops working.
Only live secret keys can be rotated or revokedYou cannot rotate or revoke test mode keys or public keys. The Dashboard shows the three-dot menu only for live secret keys.

​
If your secret key is exposed

If your live secret key is exposed, for example in a public repository, client-side code, or logs, replace the key right away:
  1. Go to the API keys page in live mode.
  2. Click Create secret key to create a new live secret key.
  3. Update your backend to use the new key.
  4. Open the three-dot menu next to the exposed key and click Revoke.
If you cannot update your backend right away, revoke the exposed key first. Requests that use the revoked key fail until you deploy the new key. If your test mode secret key is exposed, it does not affect your live operations. A test key can only access test mode resources, which do not move real money. You cannot rotate or revoke a test key, so remove it from the place where it was exposed.

​
Configure IP restrictions

You can restrict API requests to specific IP addresses. Fintoc rejects requests from all other addresses. To configure these restrictions:
  1. Go to dashboard.fintoc.com.
  2. Select API Keys in the sidebar.
  3. If your organization has products with IP restrictions enabled, turn on IP Restrictions.
  4. Click IP Restrictions and enter the IP addresses or Classless Inter-Domain Routing (CIDR) blocks from which you make requests to the Fintoc API.

​
CIDR blocks

CIDR blocks define a range of IP addresses. A CIDR block lets you specify a group of addresses instead of listing each address. For example: 192.168.1.0/24 represents all IP addresses from 192.168.1.0 to 192.168.1.255. If you do not know your CIDR block, ask your network administrator or technical team to identify the correct range.
Add at least one IP address before you turn on IP restrictionsIf you turn on IP restrictions without adding an IP address, Fintoc rejects every request.