> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Controls

In this guide, we describe the **security and safety controls** applied when creating payouts with the Fintoc Transfers API.
These controls help ensure that only authorized parties can initiate money movements, that requests cannot be altered in transit, and that payout activity can be reviewed and audited.

***

## 1. Authenticate all API requests with API keys

Every request to the Fintoc API must include an **API key**.

* API keys are **unique per organization**.
* The key is shown **only once** at creation time in the Fintoc Dashboard.
* You must store the key securely.
* If a key is lost or compromised, rotate or revoke it immediately from the Dashboard.

API keys identify the calling organization and prevent unauthorized access to the API.

📚
[Learn more](/v2023-11-15/docs/home/api-keys)

***

## 2. Sign all money movement requests with JWS

Requests that move money, such as creating outbound transfers, require an additional security layer using **JSON Web Signatures (JWS)**.

Each payout request is signed using:

* A **private JWS key**, stored securely on your side
* A **public JWS key**, registered in the Fintoc Dashboard

The JWS keys are static, but each signature is **unique and time-bound**. This is achieved by including:

* A **nonce**, which makes each signature single-use
* A **timestamp**, which limits how long the request is valid

The JWS signature:

* Protects the **integrity** of the request payload
* Confirms the **authenticity** of the sender
* Prevents **replay attacks**

Fintoc automatically rejects requests that are unsigned, expired, duplicated, or modified.

📚
[Learn more](/v2023-11-15/docs/transfers/setting-up-jws-keys)

***

## 3. Restrict API access with IP allowlisting (optional)

You can configure an **IP allowlist** in the Fintoc Dashboard to control where API requests can originate from.

When IP allowlisting is enabled:

* Requests are accepted only from approved IP addresses
* Requests from other locations are blocked, even if the API key is valid

This control reduces risk if credentials are leaked and enforces infrastructure-level access restrictions.

📚
[Learn more](/v2023-11-15/docs/home/api-keys#ip-allowlisting)

***

## 4. Verify webhook signatures

Fintoc signs all webhook events before sending them to your systems.

You should always **verify webhook signatures** before processing an event. This allows you to:

* Confirm the event was sent by Fintoc
* Detect payload tampering
* Discard forged or replayed webhook requests

Verifying webhook signatures ensures that downstream systems react only to trusted events.

📚
[Learn more](/v2023-11-15/docs/resources/webhooks-walkthrough/webhooks-validating)

***

## 5. Prevent duplicate payouts with idempotency

To avoid **accidental duplicate payouts**, Fintoc supports **idempotency mechanisms** when creating payouts.

When idempotency is used:

* Retried requests do not create duplicate transfers
* Network timeouts and client retries can be handled safely

Idempotency improves **operational safety and reliability**, especially in failure or retry scenarios.

📚
[Learn more](/v2023-11-15/docs/transfers/outbound-transfers#use-an-idempotency-key)

***

## 6. Audit API usage

All interactions with the Fintoc API are **traceable and auditable**.

This includes:

* API key–based identification of the calling organization
* Timestamped requests for sensitive operations
* Logged transfer creation and state changes

These records help you:

* Monitor and review payout activity
* Support internal audits and compliance processes
* Investigate incidents or unexpected behavior

***

## 🛡️ Controls summary

<table>
  <tr>
    <td><strong>Control</strong></td>
    <td><strong>Risk mitigated</strong></td>
  </tr>

  <tr>
    <td>API key authentication</td>
    <td>Unauthorized API access</td>
  </tr>

  <tr>
    <td>JWS-signed payout requests</td>
    <td>Payload tampering, request forgery, replay attacks</td>
  </tr>

  <tr>
    <td>IP allowlisting</td>
    <td>Credential leakage, unauthorized infrastructure access</td>
  </tr>

  <tr>
    <td>Webhook signature verification</td>
    <td>Forged or manipulated webhook events</td>
  </tr>

  <tr>
    <td>Idempotent payout creation</td>
    <td>Duplicate payouts caused by retries or network failures</td>
  </tr>

  <tr>
    <td>Auditable API activity</td>
    <td>Undetected misuse, limited traceability, audit gaps</td>
  </tr>
</table>

Together, these controls provide a <strong>defense-in-depth approach</strong> that combines authentication, integrity, operational safety, and auditability for payouts created through the Fintoc API.