Skip to content
Docs / Portal / Creating an API key

Creating an API key

Every request to the Flik API is authenticated by a key you create yourself, in the portal. It takes about a minute; the part worth reading is which of the two sets of credentials on that screen you actually need.

The Pinch keys are not yours to send The screen shows a Pinch Keys section as well — an Application ID, a Publishable Key and a Secret Key, in live and test pairs. Those are Flik's own connection to the card processor, provisioned when your application is approved, and nothing there goes in your code. What you want is under Flik Keys: a Client Id and Client Secret, which authenticate every endpoint in this documentation, card payments included.

Create a key

  1. Open API Keys

    Open API Keys in the Flik portal — it is in the sidebar — and find the Flik Keys section.

  2. Add a key

    Click the add button to open the Add API key panel.

  3. Name it

    Name is for you, not your customer. It appears in the credentials table and nowhere a payer can see, so name it after the thing that will hold it — WooCommerce production, staging — not after your company. You will be reading this list later trying to work out which key to revoke.

  4. Check the Test Mode switch first

    The panel has no test option of its own. Whether the key moves money is decided by the portal's Test Mode switch at the bottom of the sidebar: on, and you get a test key; off, a live key. The panel says which it is about to make. This cannot be changed afterwards — a key is live or test for its whole life — so if you want both, create two. The keys list shows only the keys for whichever mode the switch is in.

  5. Copy the secret before you close

    On success the panel shows Client ID and Client Secret. The secret is displayed once and is not recoverable: closing the panel without copying it means creating a new key. Put it straight into your secret store, not a scratch file.

The secret is shown once Flik stores a hash of it, not the value, so support cannot read it back to you — nobody at Flik can. If it is lost or exposed, create a replacement key, move your integration onto it, then ask us to revoke the old one.

Using the key

The Client Id and Client Secret are not sent on API requests directly. You exchange them once for an access token, then send that token for an hour. See Authentication for the exchange.

Test or live is a property of the key There is no separate test environment and no sandbox URL. The same host and the same endpoints serve both; which key you authenticate with decides whether money moves. See Testing.

Where the money lands

A key authenticates you. It does not say where funds settle — that is your organisation's bank account, set in Settings, and shared by every key you hold. Account-to-account payments cannot be created at all until it is filled in, which surfaces as settlement_account_missing rather than as anything about your key.

Previous ← API reference Next Creating a payment link →