Skip to main content
This page explains how the Fintoc CLI resolves, stores, and switches API keys. When you run fintoc login, the CLI stores your secret key in ~/.fintoc/config.toml. The file uses mode 0600, so only the current operating system user can read it. You can also provide a key with --api-key or the FINTOC_API_KEY environment variable.

​
Key resolution order

The CLI resolves the API key in this order of precedence:
  1. The inline --api-key flag.
  2. The FINTOC_API_KEY environment variable.
  3. The key stored in ~/.fintoc/config.toml by fintoc login.
The CLI uses the first available source. This precedence lets you keep a default test mode key in your configuration file and override the key for each command. Use an override to switch between Fintoc organizations or between test and live modes.

​
View your active configuration

This command prints a masked version of the active API key, the resolved environment, and the configuration file path.

​
Switch keys

To change the persisted key, log out and log back in:
To override the persisted key for a single command:

​
Use the CLI in continuous integration

For continuous integration and delivery pipelines, set FINTOC_API_KEY as a secret environment variable in your provider. For example, you can configure the variable in GitHub Actions or CircleCI. Avoid persisting credentials to disk:
This approach skips the interactive fintoc login flow and avoids writing the key to the configuration file.

​
Compare test and live modes

Each Fintoc API key is scoped to either test mode or live mode. The CLI infers the mode from the key prefix:
  • sk_test_... identifies a test mode key. A test mode key never moves real money: the CLI creates no real payments or refunds.
  • sk_live_... identifies a live mode key. Commands run with this key create real payments and refunds on your production organization.
The CLI works in both test and live modes. Resource commands such as fintoc payment_intents list work with either key. Commands that simulate events, such as fintoc trigger, run only in test mode and return an error with a live key. By default, fintoc login authenticates in test mode. To authenticate in live mode, pass --mode live: