API credentials

To call the Merchant API — or to use a plugin that asks for a key — you need an API Secret tied to your instance. You create and manage API keys in the FlowAlp Pay dashboard.

Create an API key#

1. Sign in to your dashboard at your tenant URL (for example https://demo-shop.pay.flowalp.com).
2. Open the API and Plugins section.
3. Add a new API key and give it a recognizable name — ideally the name of the system that will use it (for example "webshop backend").
4. Copy the secret value and store it in a safe place.

Each key in the list offers three actions: Copy (copy the key value), Logs (requests made with this key), and Configuration (rename the integration or regenerate the key).

What a credential consists of#

Secret handling best practices#

• Store secrets in environment variables or a secret manager — never hard-code them.
• Never ship the API Secret to browsers, mobile apps, or public repositories; call the API from your backend only.
• Never write the API Secret to application logs.
• Create one key per integration (shop, ERP, custom backend) so you can rotate or revoke each one independently.
• If a key leaks, regenerate it immediately under Configuration and update all connected systems.
• Restrict dashboard access to request logs — they can contain payment payloads.

export FLOWALP_PAY_INSTANCE="demo-shop"
export FLOWALP_PAY_API_SECRET="<api-secret>"

<?php
$instanceName = getenv('FLOWALP_PAY_INSTANCE');
$apiSecret = getenv('FLOWALP_PAY_API_SECRET');

Use the key in a request#

The default authentication method is the x-api-key HTTP header. Alternatively, requests can be signed with an HMAC-SHA256 ApiSignature — see Authentication for both methods.

GET /v1.16/SignatureCheck/?instance=demo-shop HTTP/1.1
Host: api.pay.flowalp.com
x-api-key: <api-secret>

Request logs#

For every integration, the dashboard records the requests exchanged between FlowAlp Pay and the connected system, including errors. Open API and Plugins, choose Logs next to the key, and select an entry to inspect the request details — the fastest way to debug a failing plugin or API call.