flowpay.io · Authentication Profile

Flowpayio Authentication

Authentication

Flowpay's Partner API authenticates with OAuth 2.0 client-credentials, issued by Auth0. Partners exchange a CLIENT_ID/CLIENT_SECRET for a short-lived bearer access token and present it as `Authorization: Bearer ` on every request. A PARTNER_CODE identifies the partner and a WEBHOOK_SECRET is used to verify inbound webhook HMAC signatures. The partner-implemented Sales Transactions API additionally accepts a static API key via the `X-API-Key` header. No user-facing OAuth scopes are documented (machine-to-machine client-credentials only).

flowpay.io secures its APIs with oauth2 and apiKey across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyFinancingLendingEmbedded FinanceFintechSMEOpen BankingPayments
Methods: oauth2, apiKey Schemes: 2 OAuth flows: clientCredentials API key in: header

Security Schemes

OAuth2ClientCredentials oauth2
ApiKey apiKey
· in: header ()

Source

Authentication Profile

flowpayio-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://developers.flowpay.io/specifications/fully-embedded-api/
docs: https://developers.flowpay.io/specifications/fully-embedded-api/
description: >-
  Flowpay's Partner API authenticates with OAuth 2.0 client-credentials, issued
  by Auth0. Partners exchange a CLIENT_ID/CLIENT_SECRET for a short-lived bearer
  access token and present it as `Authorization: Bearer <token>` on every
  request. A PARTNER_CODE identifies the partner and a WEBHOOK_SECRET is used to
  verify inbound webhook HMAC signatures. The partner-implemented Sales
  Transactions API additionally accepts a static API key via the `X-API-Key`
  header. No user-facing OAuth scopes are documented (machine-to-machine
  client-credentials only).
summary:
  types: [oauth2, apiKey]
  api_key_in: [header]
  oauth2_flows: [clientCredentials]
schemes:
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  token_url_production: https://flowpay.eu.auth0.com/oauth/token
  token_url_testing: https://flowpay-test.eu.auth0.com/oauth/token
  audience_production: https://api.partner.flowpay.io
  audience_testing: https://api.test.partner.flowpay.io
  presented_as: 'Authorization: Bearer <access_token>'
  credentials: [CLIENT_ID, CLIENT_SECRET, PARTNER_CODE]
  scopes: []
  sources: [https://developers.flowpay.io/specifications/fully-embedded-api/]
- name: ApiKey
  type: apiKey
  in: header
  parameter_name: X-API-Key
  applies_to: Sales Transactions API (partner-implemented data endpoint)
  sources: [https://developers.flowpay.io/specifications/sales-transactions-api/]
webhook_verification:
  mechanism: HMAC-SHA256
  signature_header: x-flowpay-sig
  timestamp_header: x-flowpay-ts
  secret: WEBHOOK_SECRET
  notes: Timestamp header guards against replay; recompute the HMAC over the raw body and compare.