• Request
• Response
• Payload examples

❗️

Tokenization not included

The API key set includes a public and a secret key, but does not include a tokenization key. As a result, tokenizing PANs (Primary Account Numbers) is not supported through this credential set. Partners using this endpoint must be PCI-certified and send full PANs in their transaction requests.

Request

Endpoints

Required Keys

Body

❗️

Key Overwrite Behavior

By default, the overwriteExistingKey flag is set to false. If set to true, it will deactivate and revoke all previously issued keys for the specified merchant, replacing them with the newly created set.

Use this flag with caution to avoid unintended disruptions in transaction processing.

Response

Field Definitions

❗️

Security forsecret keys

• The value field of secret key is only visible upon creation. Store it securely, as it cannot be retrieved later.

Payload Examples

Request

cURL Request Example

curl --request POST \
     --url https://api-sandbox.flexfactor.io/v1/merchants/\{mid}/api-keys \
     --header 'Authorization: bearer {the token returned by /oauth2}' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '{      
       "name": "New key",
 			 "description": "this is a new key for eligibility",
 			 "overwriteExistingKey": false
     }'

Response

JSON Example for a Successful Creation

{
  "name": "New key 2",
  "uniqueName": "New key 2",
  "description": "this is a new key 2",
  "clientId": "01975a64-1117-7c5a-b824-9498ds931b0a"
}

JSON Example for a Failed Creation

{
  "error": "KeyAlreadyExists",
  "message": "An API key with the name 'New key' already exists. Set 'overwriteExistingKey' to true to replace it.",
  "statusCode": 409,
  "timestamp": "2025-06-11T11:22:33.456Z"
}

Example for Handling Errors

• Missing Fields: If required fields are missing, the API returns a 400 error with detailed messages.
• Invalid Credentials: If the bearer token is invalid, the API returns a 401 error.

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "errors": [
    "Invalid scope value."
  ]
}

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "errors": [
    "Authentication failed. Invalid bearer token."
  ]
}