Skip to main content
When you sign up as a FastFlowPe merchant, the platform issues you a Client ID and a Client Secret. These two values are your permanent API identity — they never change and uniquely identify your merchant account across all interactions with FastFlowPe’s authentication system.

​
What Are Client Credentials?

Your Client ID and Client Secret serve one purpose: generating short-lived X-API-Keys. You send them as request headers to the FastFlowPe authentication endpoint, and in return you receive a fresh X-API-Key valid for 30 minutes. You do not include them directly in your payment or payout API calls. Because these credentials are permanent, securing them is critical. Anyone who holds your Client ID and Client Secret can generate a valid X-API-Key and use it to call the Payout API on behalf of your account.
Never expose your Client Secret in client-side code, public repositories, or logs. Treat it with the same level of care as a private key or database password. If your Client ID or Client Secret is ever compromised, contact FastFlowPe Support immediately to have your credentials reset.

​
Where to Find Your Credentials

Your credentials are accessible from the merchant dashboard. Navigate to: https://go.fastflowpe.com/sign-in → Login → Settings → API → API Key On this page you can view your Client ID and Client Secret. Keep this page access-controlled — only the team members who manage your API integration should be able to view these values.

​
What to Do If Credentials Are Compromised

Different types of credential exposure require different responses:
When you generate a new X-API-Key, the previous key is immediately and automatically invalidated. This means that regenerating your key is a safe and instant way to cut off access if a key is ever leaked.

​
How IP Whitelisting Complements Your Credentials

FastFlowPe’s IP whitelisting feature ensures that even a valid X-API-Key cannot be used from an unrecognized server. This adds a meaningful second layer of defense — but it does not replace the need to keep your Client ID and Client Secret secure.
IP whitelisting protects your X-API-Keys from being used outside your registered servers. It does not protect your Client ID or Client Secret. If those are exposed, an attacker could generate a new key and attempt to whitelist their own IP through other means. Always secure both layers independently.

​
X-API-Key Lifetime

Every X-API-Key you generate is valid for exactly 30 minutes from the moment it is issued. Once that window passes, the key is automatically invalidated and any request using it will return a 401 Unauthorized response. Regenerate your key before it expires to maintain uninterrupted API access.