Developers
Production and sandbox API keys, HMAC enforcement, and webhook endpoint registration for a Connect platform account.
Developers is where a Connect platform manages its credentials and its webhook endpoints.
API keys
Generate production and sandbox keys. The access key goes in the x-api-key header on every request; the secret key is only needed if you enforce HMAC, and it is shown once at generation time.
curl -X GET https://api.chargeflow.io/public/2025-04-01/health-check/access-key \
-H "x-api-key: YOUR_PLATFORM_API_KEY""OK"Full setup, including the signing string format for HMAC: Authentication and API keys.
HMAC
HMAC signature validation is off by default. Turning it on means Chargeflow verifies a signature on every inbound request, which protects against both forgery and tampering. Enable it once your integration is stable, not during first build: a wrong signature and a wrong key look identical from the outside.
Webhooks
Register an endpoint and choose which events it receives. Platform events:
| Event | Fires when |
|---|---|
dispute.created | A dispute is ingested for one of your merchants |
evidence.ready | A generated evidence package is available to fetch |
evidence.error | Generation failed for a dispute |
integration.access.error | A processor connection stopped working |
Payloads and handling are documented in Platform webhook events; registration endpoints are in the Webhooks management API.
Reply 200 to acknowledge. A non-200 is treated as a delivery failure and retried.