# API keys (https://docs.chargeflow.io/docs/reference/api-fundamentals/test-credentials)



API keys authenticate every request to the Chargeflow API. You generate them in the Chargeflow App and send the access key in the `x-api-key` header.

<ComingSoon href="/docs/merchants/sandbox">
  An isolated sandbox with separate test keys is coming. Until then, the keys you generate act on
  your live account, so build with care: read before you write, and work through the go-live
  checklist before sending production traffic.
</ComingSoon>

## What you need [#what-you-need]

Chargeflow uses API key authentication. Depending on your setup you may use one or both of these credentials:

* **API Access Key**. Sent in the `x-api-key` header on every request. This is required.
* **API Secret Key**. Only needed if you enable HMAC signature validation. It is shown once at generation time, so store it securely.

## Generate your keys [#generate-your-keys]

<Steps>
  <Step>
    Log in to the [Chargeflow App](https://app.chargeflow.io/auth/sign-in).
  </Step>

  <Step>
    Navigate to [Settings](https://app.chargeflow.io/settings#developers) and select **Developers** from the left side menu.
  </Step>

  <Step>
    Click **Generate Keys**.
  </Step>

  <Step>
    Copy your **API Access Key** and, if you plan to use HMAC, your **API Secret Key**. The secret key is only shown once.
  </Step>
</Steps>

## Use a key [#use-a-key]

Send the access key in the `x-api-key` header:

```bash title="Terminal"
curl https://api.chargeflow.io/public/2025-04-01/disputes \
  -H "x-api-key: YOUR_API_KEY"
```

<Callout title="Placeholders only">
  `YOUR_API_KEY` above is a placeholder. Use the real value you copied from the Developers section.
  Never commit a real key to source control.
</Callout>

## Key scopes and HMAC [#key-scopes-and-hmac]

By default, HMAC signature verification is disabled on newly generated access keys. In this mode the access key alone authenticates your requests, which keeps integration simple in code and in tools like Zapier or Make.

If you want an extra layer of security that guarantees request integrity and authenticity, you can enable **HMAC Signature Validation** in the Developers section. Once enabled, Chargeflow verifies the `x-chargeflow-hmac-sha256` signature on every incoming request, computed from your request data and your secret key. The signing details and code examples are in [Authentication](https://docs.chargeflow.io/docs/reference/api-fundamentals/authentication).

## Next steps [#next-steps]

<Cards>
  <Card title="Make your first call with the quickstart" href="/docs/merchants/quickstart" />

  <Card title="Review authentication and HMAC" href="/docs/reference/api-fundamentals/authentication" />

  <Card title="Read the sandbox overview" href="/docs/merchants/sandbox" />
</Cards>