Security controls

This guide describes the security controls for creating payouts with the Fintoc Transfers API. These controls restrict money movements to authorized parties and protect requests from changes in transit. They also make payout activity traceable and auditable.

---

​

1. Authenticate all API requests with API keys

Every request to the Fintoc API must include an API key.

• API keys are unique per organization.
• The Fintoc Dashboard displays the key only once when you create it.
• You must store the key securely.
• If you lose a key or suspect that it is compromised, rotate or revoke it immediately from the Dashboard.

API keys identify the organization making the request and prevent unauthorized access to the API. 📚 Learn more

---

​

2. Sign requests that move money with a JSON Web Signature (JWS)

Requests that move money, such as requests to create outbound transfers, require an additional JWS security layer. Sign each payout request with:

• A private JWS key, stored securely on your side
• A public JWS key, registered in the Fintoc Dashboard

The JWS keys are static, but each signature is unique. Include the following values in each signature:

• A nonce, which makes each signature single-use
• A timestamp, which allows Fintoc to reject expired requests

The JWS signature:

• Protects the integrity of the request payload
• Confirms the authenticity of the sender
• Prevents replay attacks

Fintoc rejects requests that are unsigned, expired, duplicated, or modified. 📚 Learn more

---

​

3. Restrict API access with IP allowlisting (optional)

You can configure an IP allowlist in the Fintoc Dashboard to restrict API requests by source IP address. When IP allowlisting is enabled:

• Fintoc accepts requests only from approved IP addresses.
• Fintoc blocks requests from other IP addresses, even if the API key is valid.

This control prevents leaked credentials from granting API access outside your approved infrastructure. 📚 Learn more

---

​

4. Verify webhook signatures

Fintoc signs all webhook events before sending them to your systems. Always verify webhook signatures before processing an event. Signature verification allows you to:

• Confirm the event was sent by Fintoc
• Detect payload tampering
• Discard forged or replayed webhook requests

Signature verification prevents downstream systems from processing untrusted events. 📚 Learn more

---

​

5. Prevent duplicate payouts with idempotency

To avoid accidental duplicate payouts, use Fintoc’s idempotency mechanism when creating payouts. Idempotency provides the following protections:

• Retried requests do not create duplicate transfers.
• You can safely retry requests after network timeouts.

📚 Learn more

---

​

6. Audit API usage

All interactions with the Fintoc API are traceable and auditable. Audit records include:

• API key–based identification of the calling organization
• Timestamped requests for sensitive operations
• Logged transfer creation and state changes

Audit records help you:

• Monitor and review payout activity
• Support internal audits and compliance processes
• Investigate incidents or unexpected behavior

---

​

🛡️ Controls summary

This table summarizes each control and the risk it mitigates:

Control	Risk mitigated
API key authentication	Unauthorized API access
JWS-signed payout requests	Payload tampering, request forgery, replay attacks
IP allowlisting	Credential leakage, unauthorized infrastructure access
Webhook signature verification	Forged or manipulated webhook events
Idempotent payout creation	Duplicate payouts caused by retries or network failures
Auditable API activity	Undetected misuse, limited traceability, audit gaps

These controls combine authentication, request integrity, operational safety, and auditability to protect payouts created through the Fintoc API.