How to authenticate requests to the Flasho Merchant API.
Authentication
Authentication
Every request to the Flasho API must be authenticated. Two methods are supported depending on your integration type.
Option A — API key (websites & servers)
The recommended method for server-side integrations.
Enable Website API
Ask your Flasho account manager to enable Website API on your merchant account.
Generate a key
In your dashboard, go to Website API and generate a new key. Keys start with flsh_.
Send the key
Include the key in every request as a Bearer token.
Authorization: Bearer flsh_YOUR_KEYOr use the alternative header:
X-Flasho-Api-Key: flsh_YOUR_KEY💡 Keep keys secret
Never expose your API key in client-side JavaScript or commit it to version control. Use environment variables.
Option B — JWT (mobile apps)
For consumer-facing mobile apps, authenticate with email and password to receive a short-lived JWT.
POST /api/v1/auth/login
Content-Type: application/json
{
"email": "[email protected]",
"password": "your-password"
}Response:
{
"token": "eyJ...",
"user": {
"id": "...",
"email": "[email protected]",
"name": "My Store",
"role": "MERCHANT"
},
"merchant": {
"id": "...",
"sellerId": "M001",
"sellerName": "My Restaurant",
"billingMode": "PREPAID",
"walletBalance": "10.000",
"scheduledDeliveryEnabled": true
}
}Store the token value and send it as Authorization: Bearer <token> on all subsequent requests.
Error responses
| HTTP code | Meaning |
|---|---|
401 | Missing or invalid API key / token |
400 | Validation error — check the request body |
404 | Resource not found |
All errors return a JSON body:
{ "error": "Human-readable message" }