Skip to main content
Every request to https://api.finowl.co/v1 must include your API key in the Authorization header:
A missing, malformed or revoked key returns 401 with {"error": {"code": "unauthorized"}}, and nothing is charged.

​
Create a key

  1. Open API Keys in the dashboard.
  2. Select Create key and give it a descriptive label, such as billing-service-prod.
  3. Copy the key immediately. It is shown only once.
Finowl stores only a hash of each key, so a lost key cannot be recovered. Create a new one instead.

​
Key format

Keys look like this:
The prefix (finowl_ plus 24 characters) is not secret. It is shown in the dashboard so you can tell keys apart, and it is safe to log. The part after the dot is the secret.
The finowl_ prefix makes keys easy to find with secret scanners such as GitHub secret scanning or gitleaks. Add it to your scanner rules.

​
Keep keys safe

The API does not send CORS headers, so browsers block direct calls. That is deliberate: a key in frontend code or a mobile app can be extracted by anyone. Call Finowl from your backend and return only what your client needs.
Separate keys for production, staging and each service let you revoke one without breaking the others. The dashboard shows when each key was last used, which makes unused keys easy to spot.
Load keys from environment variables or a secret manager such as AWS Secrets Manager, Google Secret Manager, Doppler or Vault. Never commit them to source control.
Check that your HTTP client, proxy and error tracker redact the Authorization header. Log the key prefix if you need to know which key was used.

​
Rotate a key

Rotate keys on a schedule, when someone with access leaves, or immediately if a key may have leaked.
1

Create a new key

Create a replacement key in the dashboard with a clear label.
2

Deploy it

Update your secret store and deploy. Both keys work at the same time, so there is no downtime.
3

Revoke the old key

Once the old key’s last used time stops updating, revoke it. Revocation takes effect immediately.
If a key has leaked, revoke it first and deploy the replacement second. A short outage is better than someone else spending your credits.

​
Credits are per account

All keys on an account share the same credit balance and the same rate limit. Revoking a key does not affect your balance.