• Overview
• Constructing the header
• Request

Overview

As an alternative to the OAuth2 bearer token flow, merchants and partners may authenticate requests using HTTP Basic Authentication. This produces the same authorization headers used today, but removes the need to make a separate call to the /oauth2/token endpoint before each session.

Instead of exchanging your credentials for a short-lived bearer token, you send your API Key and API Secret directly on every request using the Authorization: Basic header.

📘

Not enabled by default

Basic Authentication is not enabled by default. FlexFactor must enable this for your integration before you can use it.

Constructing the header

Build the credential string by joining your API Key and API Secret with a single period (.), then Base64-encode the result:

{API Key}.{API Secret}

Base64-encode that string and send it on the Authorization header, prefixed with Basic:

Authorization: Basic <base64( {API Key}.{API Secret} )>

For example, given an API Key of d572283e-1cd2-4c8b-9944-6d994ffc120e and an API Secret of LLw_oYT_zDsV46Cq_wuOGw, you would Base64-encode:

d572283e-1cd2-4c8b-9944-6d994ffc120e.LLw_oYT_zDsV46Cq_wuOGw

Required keys

Log into your Sandbox. Go to section Developers > Api Keys to get both your API Key and API Secret.

Request

Send the Authorization: Basic header on each API request. No call to /oauth2/token is required.

curl --location -g --request POST '{URL}/transmit' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic {base64(API Key.API Secret)}' \
--data-raw '{ }'

var axios = require('axios');

// Join API Key and API Secret with a period, then Base64-encode.
var apiKey = '{Replace with your API Key found on the portal}';
var apiSecret = '{Replace with your API Secret found on the portal}';
var credentials = Buffer.from(apiKey + '.' + apiSecret).toString('base64');

var config = {
  method: 'post',
  url: '{{URL}}/transmit',
  headers: {
    'Content-Type': 'application/json',
    'Authorization': 'Basic ' + credentials
  },
  data: JSON.stringify({ })
};

axios(config)
.then(function (response) {
  console.log(JSON.stringify(response.data));
})
.catch(function (error) {
  console.log(error);
});

❕

Keep your API Secret confidential.

The Base64-encoded credential is not encrypted — it is only encoded. Always send requests over HTTPS and never expose your API Secret in client-side code.