> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastflowpe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Client Credentials

> Your Client ID and Client Secret are permanent credentials issued at signup. Find them in the dashboard and use them to generate X-API-Keys.

When you sign up as a FastFlowPe merchant, the platform issues you a **Client ID** and a **Client Secret**. These two values are your permanent API identity — they never change and uniquely identify your merchant account across all interactions with FastFlowPe's authentication system.

## What Are Client Credentials?

Your Client ID and Client Secret serve one purpose: generating short-lived X-API-Keys. You send them as request headers to the FastFlowPe authentication endpoint, and in return you receive a fresh X-API-Key valid for 30 minutes. You do not include them directly in your payment or payout API calls.

Because these credentials are permanent, securing them is critical. Anyone who holds your Client ID and Client Secret can generate a valid X-API-Key and use it to call the Payout API on behalf of your account.

<Warning>
  Never expose your Client Secret in client-side code, public repositories, or logs. Treat it with the same level of care as a private key or database password. If your Client ID or Client Secret is ever compromised, contact **FastFlowPe Support immediately** to have your credentials reset.
</Warning>

## Where to Find Your Credentials

Your credentials are accessible from the merchant dashboard. Navigate to:

**[https://go.fastflowpe.com/sign-in](https://go.fastflowpe.com/sign-in) → Login → Settings → API → API Key**

On this page you can view your Client ID and Client Secret. Keep this page access-controlled — only the team members who manage your API integration should be able to view these values.

## What to Do If Credentials Are Compromised

Different types of credential exposure require different responses:

| Scenario                              | Action                                                                                           |
| ------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Client ID or Client Secret is exposed | Contact FastFlowPe Support immediately to reset your permanent credentials                       |
| X-API-Key is leaked or misused        | Regenerate it via the dashboard or the authentication API — the old key is automatically revoked |

<Note>
  When you generate a new X-API-Key, the previous key is immediately and automatically invalidated. This means that regenerating your key is a safe and instant way to cut off access if a key is ever leaked.
</Note>

## How IP Whitelisting Complements Your Credentials

FastFlowPe's IP whitelisting feature ensures that even a valid X-API-Key cannot be used from an unrecognized server. This adds a meaningful second layer of defense — but it does not replace the need to keep your Client ID and Client Secret secure.

<Info>
  IP whitelisting protects your X-API-Keys from being used outside your registered servers. It does **not** protect your Client ID or Client Secret. If those are exposed, an attacker could generate a new key and attempt to whitelist their own IP through other means. Always secure both layers independently.
</Info>

## X-API-Key Lifetime

Every X-API-Key you generate is valid for exactly **30 minutes** from the moment it is issued. Once that window passes, the key is automatically invalidated and any request using it will return a `401 Unauthorized` response. Regenerate your key before it expires to maintain uninterrupted API access.