API keys
How to generate and use Chargeflow API keys, and what the secret key is for.
API keys authenticate every request to the Chargeflow API. You generate them in the Chargeflow App and send the access key in the x-api-key header.
An isolated sandbox with separate test keys is coming. Until then, the keys you generate act on your live account, so build with care: read before you write, and work through the go-live checklist before sending production traffic.
What you need
Chargeflow uses API key authentication. Depending on your setup you may use one or both of these credentials:
- API Access Key. Sent in the
x-api-keyheader on every request. This is required. - API Secret Key. Only needed if you enable HMAC signature validation. It is shown once at generation time, so store it securely.
Generate your keys
Log in to the Chargeflow App.
Navigate to Settings and select Developers from the left side menu.
Click Generate Keys.
Copy your API Access Key and, if you plan to use HMAC, your API Secret Key. The secret key is only shown once.
Use a key
Send the access key in the x-api-key header:
curl https://api.chargeflow.io/public/2025-04-01/disputes \
-H "x-api-key: YOUR_API_KEY"Placeholders only
YOUR_API_KEY above is a placeholder. Use the real value you copied from the Developers section. Never commit a real key to source control.
Key scopes and HMAC
By default, HMAC signature verification is disabled on newly generated access keys. In this mode the access key alone authenticates your requests, which keeps integration simple in code and in tools like Zapier or Make.
If you want an extra layer of security that guarantees request integrity and authenticity, you can enable HMAC Signature Validation in the Developers section. Once enabled, Chargeflow verifies the x-chargeflow-hmac-sha256 signature on every incoming request, computed from your request data and your secret key. The signing details and code examples are in Authentication.