Authentication

The Figo API uses API keys. There is no user login. Every request must include a valid key. The key identifies your merchant account, so a key can act only on your own resources.

API keys

A key looks like:

sk_live_a1b2c3d4e5f6…      ← live environment
sk_test_a1b2c3d4e5f6…      ← test environment

• The sk_ prefix marks a secret key. Use it only on your server. Do not put it in a browser, a mobile app, or a public repository.
• The environment part (live or test) controls if real money moves.
• We show the full key one time, when you create it. We keep only a hash and a short prefix such as sk_live_a1b2c3. If you lose the key, roll it.
• Test keys are the exception. A sandbox key can be read back from your dashboard, because a key that authenticates against play money is not worth losing an afternoon over. A live key cannot, and never will be.

Create, rotate, and revoke keys in your dashboard — dashboard-sandbox.spendfigo.com for test keys, dashboard.spendfigo.com for live keys.

Sending the key

Pass the key either way — pick one:

Preferred — x-api-key header:

curl {BASE_URL}/v1/corridors \
  -H "x-api-key: sk_live_your_key_here"

Or Authorization: Bearer:

curl {BASE_URL}/v1/corridors \
  -H "Authorization: Bearer sk_live_your_key_here"

Environments

Build against test first. The request and response shapes are the same as live.

Rolling a key

Roll a key if a person who must not have it can see it. A roll revokes the old key and makes a new key with the same name and environment. The old key stops immediately. Deploy the new key first.

Errors

See Conventions → Errors for the error body shape.