> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security controls

This guide describes the **security controls** for creating payouts with the Fintoc Transfers API.
These controls restrict money movements to authorized parties and protect requests from changes in transit. They also make payout activity traceable and auditable.

***

## 1. Authenticate all API requests with API keys

Every request to the Fintoc API must include an **API key**.

* API keys are **unique per organization**.
* The Fintoc Dashboard displays the key **only once** when you create it.
* You must store the key securely.
* If you lose a key or suspect that it is compromised, rotate or revoke it immediately from the Dashboard.

API keys identify the organization making the request and prevent unauthorized access to the API.

📚
[Learn more](/v2023-11-15/guides/home/api-keys)

***

## 2. Sign requests that move money with a JSON Web Signature (JWS)

Requests that move money, such as requests to create outbound transfers, require an additional **JWS** security layer.

Sign each payout request with:

* A **private JWS key**, stored securely on your side
* A **public JWS key**, registered in the Fintoc Dashboard

The JWS keys are static, but each signature is **unique**. Include the following values in each signature:

* A **nonce**, which makes each signature single-use
* A **timestamp**, which allows Fintoc to reject expired requests

The JWS signature:

* Protects the **integrity** of the request payload
* Confirms the **authenticity** of the sender
* Prevents **replay attacks**

Fintoc rejects requests that are unsigned, expired, duplicated, or modified.

📚
[Learn more](/v2023-11-15/guides/transfers/setting-up-jws-keys)

***

## 3. Restrict API access with IP allowlisting (optional)

You can configure an **IP allowlist** in the Fintoc Dashboard to restrict API requests by source IP address.

When IP allowlisting is enabled:

* Fintoc accepts requests only from approved IP addresses.
* Fintoc blocks requests from other IP addresses, even if the API key is valid.

This control prevents leaked credentials from granting API access outside your approved infrastructure.

📚
[Learn more](/v2023-11-15/guides/home/api-keys#ip-allowlisting)

***

## 4. Verify webhook signatures

Fintoc signs all webhook events before sending them to your systems.

Always **verify webhook signatures** before processing an event. Signature verification allows you to:

* Confirm the event was sent by Fintoc
* Detect payload tampering
* Discard forged or replayed webhook requests

Signature verification prevents downstream systems from processing untrusted events.

📚
[Learn more](/v2023-11-15/guides/resources/webhooks-walkthrough/webhooks-validating)

***

## 5. Prevent duplicate payouts with idempotency

To avoid **accidental duplicate payouts**, use Fintoc's **idempotency mechanism** when creating payouts.

Idempotency provides the following protections:

* Retried requests do not create duplicate transfers.
* You can safely retry requests after network timeouts.

📚
[Learn more](/v2023-11-15/guides/transfers/outbound-transfers#use-an-idempotency-key)

***

## 6. Audit API usage

All interactions with the Fintoc API are **traceable and auditable**.

Audit records include:

* API key–based identification of the calling organization
* Timestamped requests for sensitive operations
* Logged transfer creation and state changes

Audit records help you:

* Monitor and review payout activity
* Support internal audits and compliance processes
* Investigate incidents or unexpected behavior

***

## 🛡️ Controls summary

This table summarizes each control and the risk it mitigates:

<table>
  <tr>
    <td><strong>Control</strong></td>
    <td><strong>Risk mitigated</strong></td>
  </tr>

  <tr>
    <td>API key authentication</td>
    <td>Unauthorized API access</td>
  </tr>

  <tr>
    <td>JWS-signed payout requests</td>
    <td>Payload tampering, request forgery, replay attacks</td>
  </tr>

  <tr>
    <td>IP allowlisting</td>
    <td>Credential leakage, unauthorized infrastructure access</td>
  </tr>

  <tr>
    <td>Webhook signature verification</td>
    <td>Forged or manipulated webhook events</td>
  </tr>

  <tr>
    <td>Idempotent payout creation</td>
    <td>Duplicate payouts caused by retries or network failures</td>
  </tr>

  <tr>
    <td>Auditable API activity</td>
    <td>Undetected misuse, limited traceability, audit gaps</td>
  </tr>
</table>

These controls combine authentication, request integrity, operational safety, and auditability to protect payouts created through the Fintoc API.