Overview
API authentication
Authenticate Remitflex API requests with API keys, understand scopes, and handle auth errors.
GET
List transactions
Business endpoints accept an API key as a Bearer token. Key management requires a dashboard JWT and is not available via API key.
Authorization header
Key prefixes
Obtaining keys
- Log in at dashboard.remitflex.io.
- Go to Settings → API Keys.
- Create a key with full access (
api:read+api:write) unless you only need a read-only reporter. - Copy the raw key immediately — it cannot be retrieved later.
Scopes
Secret API keys useapi:read and/or api:write (write implies read). Publishable keys (rmf_pk_*) are limited to payment-link embed reads (collections:read).
A 403 response with Missing required scopes: ... means the key is valid but lacks permission. Create a new key with the required scopes.
Auth errors
- 401 — Invalid key
- 403 — Missing scope
- 400 — No idempotency key
Dashboard JWT
The dashboard uses JWT access tokens (Authorization: Bearer eyJ...) with full access to business routes. JWT is required for /v1/auth/* and /v1/api-keys/*.
See the Authentication guide for the full key-creation workflow.Authorizations
API key created in the Remitflex Dashboard at dashboard.remitflex.io (rmf_live_... or rmf_test_...).
Key management endpoints require a dashboard JWT and are not part of this reference.
Query Parameters
Filter results to a single customer under your organisation.
Example:
"a1b2c3d4-e5f6-7890-abcd-ef1234567890"