Authentication

Every server-side call is authenticated with your secret key.

Key types

Key	Role
af_live_pub_...	Public key. Identifies your application and may appear client-side (widget, SoftPay). It can only create sessions and read their payment methods and status.
af_live_sec_...	Secret key. Signs your API calls and your webhooks. Server-side only.
af_test_pub_... / af_test_sec_...	The same, in test mode: no aggregator called, simulated payments, isolated data. See Test mode.

Usage

Pass the secret key in the Authorization: Bearer <key> header. The x-api-key: <key> header is accepted as an alternative. Every object response (session, transfer, webhook delivery) and every webhook carries livemode: true with a production key, false with a test key.

curl

curl https://cartflox.com/api/v1/config/webhook \
  -H "Authorization: Bearer af_live_sec_YOUR_KEY"

Rotation

From API and Logs, you can regenerate your keys. The old secret key stops working immediately: update your servers before confirming.

Key exposed?

Regenerate it right away. A leaked secret key can be used to create payment sessions in your name and to forge webhooks.