Skip to main content
Fintoc uses API keys to authenticate your API requests. Fintoc returns an error if a request has no key or an incorrect key. This page explains key types and environments, key management and rotation, and IP address restrictions. Every Fintoc account has two key pairs: one for test mode and one for live mode. Each resource belongs to one environment. A key cannot access resources in the other environment. Each pair contains two types of API key:
  • Use the public key to identify your account in Fintoc and integrate the Widget. The public key is not secret.
  • Use the secret key to query the Fintoc API. Keep your secret key private and use it only from your application’s backend.
When you create an account, Fintoc provides four keys: a public key and a secret key for test mode, and a public key and a secret key for live mode.

​
Get your API keys

You can access your secret API key for live mode only onceYou can view and copy a secret API key only when you activate or rotate the key. Store secret keys securely in your backend.
You can activate and manage your API keys from the Dashboard.

​
Rotate your API keys

We recommend rotating your API keys at least once a year. You can rotate your API keys from the Dashboard.

​
Configure IP restrictions

You can restrict API requests to specific IP addresses. Fintoc rejects requests from all other addresses. To configure these restrictions:
  1. Go to dashboard.fintoc.com.
  2. Select API Keys in the sidebar.
  3. If your organization has products with IP restrictions enabled, turn on IP Restrictions.
  4. Click IP Restrictions and enter the IP addresses or Classless Inter-Domain Routing (CIDR) blocks from which you make requests to the Fintoc API.

​
CIDR blocks

CIDR blocks define a range of IP addresses. A CIDR block lets you specify a group of addresses instead of listing each address. For example: 192.168.1.0/24 represents all IP addresses from 192.168.1.0 to 192.168.1.255. If you do not know your CIDR block, ask your network administrator or technical team to identify the correct range.
Add at least one IP address before you turn on IP restrictionsIf you turn on IP restrictions without adding an IP address, Fintoc rejects every request.