Skip to main content

Overview

The FLEX Merchant API uses API Key authentication with three required headers for secure access. All requests must include valid credentials to be processed.

Required Headers

Every API request must include the following headers:
string
required
Your unique merchant client identifier
string
required
Your secret API key for authentication
string
required
Your merchant location identifier (required for most endpoints)
The x-location header is optional only for the Resolve PayTag endpoint. All other endpoints require it.

Getting Your Credentials

To obtain your API credentials:
  1. Sign up for a FLEX merchant account
  2. Complete merchant verification
  3. Request API access from your merchant dashboard or contact support
  4. Receive your credentials via secure email:
    • Client ID
    • API Key
    • Location identifier(s)
Never expose your API key in client-side code, public repositories, or logs. Always store credentials securely using environment variables or secret management systems.

Authentication Example

Authentication Errors

Error Message: "client id is missing!"Cause: The x-client-id header was not providedSolution: Ensure you include the x-client-id header in your request
Error Message: "API key is missing!"Cause: The x-api-key header was not providedSolution: Ensure you include the x-api-key header in your request
Error Message: "Unauthorized"Cause: Invalid credentials or disabled merchant accountSolution:
  • Verify your client ID and API key are correct
  • Check if your merchant account is active
  • Contact support if the issue persists
Error Message: "Merchant not found"Cause: The merchant account associated with your credentials is not found or disabledSolution: Contact FLEX support to verify your account status

Legacy Headers (Deprecated)

The following headers are deprecated and will be removed in a future version. Please migrate to the new x-* headers.

Best Practices

Use Environment Variables

Store credentials in environment variables, never hardcode them

Rotate Keys Regularly

Periodically rotate your API keys for enhanced security

Monitor Usage

Track API usage to detect unauthorized access

Use HTTPS Only

Always use HTTPS endpoints to encrypt data in transit

Testing Authentication

Use this simple endpoint to verify your credentials are working:
Expected Response (200 OK):
If you receive this response, your authentication is configured correctly!

Next Steps

Integration Guide

Start integrating the API into your application

API Reference

Explore available endpoints