Chargeflow API FAQ: Authentication, Webhooks, Disputes & Security

You are evaluating or integrating Chargeflow and need a quick answer - on the API, security, data handling, or how Chargeflow operates. Each answer here is short by design and links to the page where the topic is documented in full.

Getting started

Authentication

Environments

Errors

Webhooks

Disputes

Alerts

Prevent

API versioning

Security & compliance

Data & privacy

How Chargeflow operates

Next steps

Start with the Quickstart.
Review the go-live checklist before production.
Still stuck? Contact Support.

FAQ

What platform do I need to connect to use the API?

I generated an API key - what do I do with it?

Does my plan affect API access, or does someone have to approve it?

Can I pull my dispute data into an AI tool like Claude or ChatGPT?

How do I authenticate API requests?

Where do I get my API keys?

What is the API key for? Is it only for webhooks?

Where do I enter the API key - in my CRM or in my PSP portal?

What is HMAC signature validation and do I need it?

Is there a test or sandbox environment?

What base URL should I call?

Am I rate limited?

Can I safely retry a failed request?

Why do I get 403 Forbidden on every endpoint, including the health check? Is my API access disabled?

Why do I get 'Missing API Key header x-api-key' when my key has not changed?

My key is valid but I cannot list alerts or disputes - is that an access-level restriction?

How do I set up webhooks?

What URL do I use for the webhook?

Is there a webhook for when a dispute is updated, not just created?

How do I verify that a webhook came from Chargeflow?

What should my endpoint return?

Where do disputes come from?

How do I know when a new dispute is created?

How do I add evidence or order data to a dispute?

Will data I do not send still be used in the dispute response?

I enriched a dispute via API - where do I confirm it landed?

What is a pre-chargeback alert?

Does Chargeflow resolve alerts for me?

Can I receive alerts via API without Chargeflow processing the refund?

Does Prevent support an API or a custom integration?

How does versioning work?

Which version should I use?

Is Chargeflow SOC 2 certified?

Do you have a PCI attestation?

Where do I get the SOC 2 report, penetration test, or DPA?

Has Chargeflow had any security incidents?

What customer data does Chargeflow store?

Where is my data hosted, and do you support data residency?

How is a GDPR or data-subject request handled?

Do you use my data to train AI models?

Does Chargeflow contact my customers directly?

Will you alert me if there is a problem with my integration, or is that my responsibility?

How does billing and the deposit work?

On this page