EasyflowEasyflowDocs

Authentication

Authenticate your requests with your API key and API secret, and send the business identifier where an endpoint requires it.

On this page

The Easyflow API authenticates requests with HTTP headers. There are no sessions or cookies: send your credentials with every request.

Credential headers

Header When to send it Description
x-api-key Every request API key provided on the Integrations tab of the Easyflow platform.
x-api-secret Every request API secret provided on the Integrations tab of the Easyflow platform.
business-id When the endpoint requires it Identifier of the business the request refers to.

Each endpoint page in the API reference lists the headers it expects in its Headers section.

curl --request GET \
  --url 'https://9iq81tsdy4.execute-api.sa-east-1.amazonaws.com/business/balance' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'x-api-secret: YOUR_API_SECRET' \
  --header 'business-id: YOUR_BUSINESS_ID'

The business identifier

Endpoints that act on a business, such as Get balance, Get order, Filter products and most payment link endpoints, take the business identifier in the business-id header. The requirement varies by endpoint, so check the Headers section of the endpoint you are calling.

You can list the businesses that belong to your account, and their identifiers, with List businesses by owner.

A few endpoints that create resources receive the business in the request body instead, in a businessId field. Create charge and Create customer are examples.

Authentication errors

When the credentials are missing or invalid, the API answers with 401 Unauthorized:

{
  "message": "Unauthorized",
  "error": "Unauthorized",
  "statusCode": 401
}

When the credentials are valid but cannot access the requested resource, the API answers with 403 Forbidden:

{
  "message": "Forbidden resource",
  "error": "Forbidden",
  "statusCode": 403
}

Keep your credentials safe

  • Call the API only from your server. Your API secret must never reach browsers, mobile apps or other client-side code.
  • Store the credentials in environment variables or in a secrets manager, never in source code.
  • Always send requests to the HTTPS base URL shown in the API reference.
  • Give access to the credentials only to the people and services that need them.