Authentication

All Fikäfi APIs require secure access via Bearer Token authentication.

Every API request must include an Authorization header with a valid Bearer token.

Use your Client ID and Secret Key to authenticate and receive a token.

If you don’t have credentials, please contact our integration team.

Endpoint: POST /auth/token

Header

Request

{
  "clientId": "your-client-id",
  "secretKey": "your-secret-key"
}

Response

{
  "accessToken": "abcdef1234567890",
  "tokenType": "Bearer",
  "expiresIn": 86400
}

Include the accessToken in the Authorization header for all API requests:

Authorization: Bearer your_access_token

Tokens are usually valid for 24 hours (86400 seconds)

Always check the expiresIn value in the response

Refresh the token before expiry to avoid failed requests

Never expose your Client ID or Secret Key in frontend code

Use HTTPS for all API requests

Store credentials securely and rotate them periodically

You get separate credentials for sandbox and production