FlowAlp

SignatureCheck: verify API credentials

July 30, 2026

Validate your FlowAlp Pay API credentials and signature calculation with the SignatureCheck endpoint — curl and PHP examples included.

SignatureCheck is a read-only endpoint that confirms your instance name, your API secret and — in signature mode — your HMAC computation are correct. It is the recommended first call of every new integration.

GEThttps://api.pay.flowalp.com/v1.16/SignatureCheck/v1.14 · v1.15 · v1.16

Request

ParameterLocationTypeRequiredDescription
instancequerystringyesYour merchant instance name

There is no request body. Authenticate with the x-api-key header or, in signature mode, append an ApiSignature parameter — since no other parameters are involved, the signed query string is empty. Both methods are described in Merchant API authentication.

curl with x-api-keybash
curl --request GET \
  --url "https://api.pay.flowalp.com/v1.16/SignatureCheck/?instance=<instance>" \
  --header "x-api-key: <api-secret>"
curl with ApiSignaturebash
API_SECRET="<api-secret>"

# HMAC-SHA256 of the empty parameter string, Base64-encoded
SIGNATURE=$(printf '' \
  | openssl dgst -sha256 -hmac "$API_SECRET" -binary \
  | openssl enc -base64)

curl --get \
  --url "https://api.pay.flowalp.com/v1.16/SignatureCheck/" \
  --data-urlencode "instance=<instance>" \
  --data-urlencode "ApiSignature=$SIGNATURE"
PHP (cURL)PHP
<?php
$instance  = getenv('FLOWALP_PAY_INSTANCE');
$apiSecret = getenv('FLOWALP_PAY_API_SECRET');

$ch = curl_init(
    'https://api.pay.flowalp.com/v1.16/SignatureCheck/?instance=' . urlencode($instance)
);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['x-api-key: ' . $apiSecret]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$body   = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

$result = json_decode($body, true);

if ($status === 200 && ($result['status'] ?? null) === 'success') {
    echo "Credentials OK\n";
} else {
    echo "Check failed: HTTP {$status} - {$body}\n";
}

Response

Typical success responseJSON
{
  "status": "success",
  "data": [
    {
      "id": 1
    }
  ]
}

If the credentials are wrong, the API answers with an error status instead: an authentication failure and a body whose status field is error. Fix instance and secret before calling any other endpoint; the general shape is described in Merchant API errors.

Errors

CauseTypical signalFix
Wrong or missing API secretError status instead of successCopy the secret again from the dashboard; check the header name
Wrong instance nameError statusUse the subdomain of your payment page, for example demo-shop for demo-shop.pay.flowalp.com
Broken signature encodingError status in ApiSignature mode onlyCompare your query-string encoding with the reference implementation

When to use it

  • Right after onboarding, to confirm the credentials from API credentials.
  • After rotating the API secret.
  • In deployment smoke tests — but mind the rate limits; do not call it in a tight health-check loop.
  • When porting the ApiSignature algorithm to a new language.

Check passed? Continue with your first API request or create a Gateway.