# Developers (https://docs.chargeflow.io/docs/platforms/connect/developers)



Developers is where a Connect platform manages its credentials and its webhook endpoints.

## API keys [#api-keys]

Generate **production** and **sandbox** keys. The access key goes in the `x-api-key` header on every request; the secret key is only needed if you enforce HMAC, and it is shown once at generation time.

```bash title="Terminal"
curl -X GET https://api.chargeflow.io/public/2025-04-01/health-check/access-key \
  -H "x-api-key: YOUR_PLATFORM_API_KEY"
```

```json title="Response"
"OK"
```

Full setup, including the signing string format for HMAC: [Authentication](https://docs.chargeflow.io/docs/reference/api-fundamentals/authentication) and [API keys](https://docs.chargeflow.io/docs/reference/api-fundamentals/test-credentials).

## HMAC [#hmac]

HMAC signature validation is off by default. Turning it on means Chargeflow verifies a signature on every inbound request, which protects against both forgery and tampering. Enable it once your integration is stable, not during first build: a wrong signature and a wrong key look identical from the outside.

## Webhooks [#webhooks]

Register an endpoint and choose which events it receives. Platform events:

| Event                      | Fires when                                         |
| -------------------------- | -------------------------------------------------- |
| `dispute.created`          | A dispute is ingested for one of your merchants    |
| `evidence.ready`           | A generated evidence package is available to fetch |
| `evidence.error`           | Generation failed for a dispute                    |
| `integration.access.error` | A processor connection stopped working             |

Payloads and handling are documented in [Platform webhook events](https://docs.chargeflow.io/docs/platforms/webhook-events); registration endpoints are in the [Webhooks management API](https://docs.chargeflow.io/docs/api/2025-04-01/merchants/webhooks-management).

Reply `200` to acknowledge. A non-`200` is treated as a delivery failure and retried.

## Next step [#next-step]

<Cards>
  <Card className="cf-card-outline" iconName="card-chip-1" title="Platforms quickstart" href="/docs/platforms/quickstart">
    Use the key you just generated: evidence in four steps.
  </Card>
</Cards>