Authentication and keys
Give your server only the permissions its integration needs.
On this page
Create a secret key
In a freelancer or merchant profile, open Developers and create a key. This action needs a fresh sign-in. Copy its secret once and store it on your server.
Send Authorization: Bearer fw_test_… on API requests. Never include this key in browser code, source control or a public environment variable.
| Field | Details |
|---|---|
invoices.readscope | Read invoices, checkout sessions, payments and webhook events. |
invoices.writescope | Create invoices and checkout sessions; expire unpaid checkout attempts. |
stores.readscope | Read permitted stores. |
tokens.readscope | Read enabled token choices and profile switches. |
Profile, store and mode
A key belongs to one profile. A merchant key is scoped to one store and cannot read another store’s invoices or events.
Keys cannot move money, edit billing details or manage the team. Store creation and token settings remain app actions.
Replace or revoke a key
Roll a key to replace it while allowing an overlap of up to seven days. Revoke it to stop access immediately.
An expired, revoked or incorrect key returns invalid_api_key. Missing permissions return forbidden.