> ## Documentation Index
> Fetch the complete documentation index at: https://docs.remitflex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API authentication

> Authenticate Remitflex API requests with API keys, understand scopes, and handle auth errors.

Business endpoints accept an API key as a Bearer token. Key management requires a dashboard JWT and is not available via API key.

## Authorization header

```
Authorization: Bearer rmf_live_xxxxxxxxSSSSSSSSSSSSSSSSSSSSSS
```

<CodeGroup>
  ```bash curl theme={null}
  curl -X GET https://api.remitflex.io/v1/transactions \
    -H "Authorization: Bearer rmf_test_xxxx"
  ```

  ```javascript JavaScript theme={null}
  const res = await fetch("https://api.remitflex.io/v1/transactions", {
    headers: { Authorization: `Bearer ${process.env.REMITFLEX_API_KEY}` },
  });
  ```

  ```python Python theme={null}
  import os, requests
  r = requests.get(
      "https://api.remitflex.io/v1/transactions",
      headers={"Authorization": f"Bearer {os.environ['REMITFLEX_API_KEY']}"},
  )
  ```
</CodeGroup>

## Key prefixes

| Prefix      | Environment    |
| ----------- | -------------- |
| `rmf_test_` | Test / sandbox |
| `rmf_live_` | Production     |

<Warning>
  Live keys move real funds on-chain. Use `rmf_test_` keys during development.
</Warning>

## Obtaining keys

1. Log in at [dashboard.remitflex.io](https://dashboard.remitflex.io).
2. Go to **Settings → API Keys**.
3. Create a key with **full access** (`api:read` + `api:write`) unless you only need a read-only reporter.
4. Copy the raw key immediately — it cannot be retrieved later.

## Scopes

Secret API keys use **`api:read`** and/or **`api:write`** (write implies read). Publishable keys (`rmf_pk_*`) are limited to payment-link embed reads (`collections:read`).

A `403` response with `Missing required scopes: ...` means the key is valid but lacks permission. Create a new key with the required scopes.

## Auth errors

<Tabs>
  <Tab title="401 — Invalid key">
    ```json theme={null}
    {
      "status": "error",
      "message": "Invalid API key"
    }
    ```
  </Tab>

  <Tab title="403 — Missing scope">
    ```json theme={null}
    {
      "status": "error",
      "message": "Missing required scopes: api:write"
    }
    ```
  </Tab>

  <Tab title="400 — No idempotency key">
    ```json theme={null}
    {
      "status": "error",
      "message": "Idempotency-Key header is required for mutating API requests"
    }
    ```
  </Tab>
</Tabs>

## Dashboard JWT

The dashboard uses JWT access tokens (`Authorization: Bearer eyJ...`) with full access to business routes. JWT is required for `/v1/auth/*` and `/v1/api-keys/*`.

See the [Authentication guide](/authentication) for the full key-creation workflow.


## OpenAPI

````yaml GET /transactions
openapi: 3.1.0
info:
  title: Remitflex API
  version: 1.0.0
  description: >
    Programmatic access to Remitflex payment routes, fiat rates, customers, and
    transactions.


    **Dashboard:** Create API keys at https://dashboard.remitflex.io


    **Authentication:** Send your API key as `Authorization: Bearer
    rmf_live_...` or `rmf_test_...`.


    **Idempotency:** Mutating requests (`POST`, `PUT`, `PATCH`, `DELETE`)
    require an `Idempotency-Key` header when authenticated with an API key.
servers:
  - url: http://localhost:4000/v1
    description: Local development
  - url: https://api.remitflex.io/v1
    description: Production
security:
  - ApiKeyAuth: []
paths:
  /transactions:
    get:
      tags:
        - Transactions
      summary: List transactions
      description: >-
        Unified ledger of payment-route deposits. Optionally filter by
        `customerId`. Requires `api:read` scope.
      operationId: listTransactions
      parameters:
        - $ref: '#/components/parameters/CustomerIdQuery'
      responses:
        '200':
          $ref: '#/components/responses/ListTransactions'
      security:
        - ApiKeyAuth: []
components:
  parameters:
    CustomerIdQuery:
      name: customerId
      in: query
      required: false
      description: Filter results to a single customer under your organisation.
      schema:
        type: string
        format: uuid
        example: a1b2c3d4-e5f6-7890-abcd-ef1234567890
  responses:
    ListTransactions:
      description: Unified transaction ledger
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/SuccessEnvelope'
              - type: object
                properties:
                  data:
                    type: object
                    properties:
                      transactions:
                        type: array
                        items:
                          $ref: '#/components/schemas/Transaction'
                      total:
                        type: integer
          examples:
            success:
              $ref: '#/components/examples/ListTransactionsResponse'
  schemas:
    SuccessEnvelope:
      type: object
      properties:
        status:
          type: string
          example: success
        message:
          type: string
        data:
          nullable: true
    Transaction:
      type: object
      properties:
        id:
          type: string
        kind:
          type: string
          enum:
            - payment_route
            - swap
            - collection
            - offramp
            - onramp
            - cngn_convert
            - cngn_withdrawal
            - cngn_payout
            - cngn_payin
            - cngn_deposit
        customerId:
          type: string
          format: uuid
          nullable: true
        customerName:
          type: string
        status:
          type: string
        destination:
          type: string
        amount:
          type: string
        amountUsd:
          type: string
          nullable: true
        createdAt:
          type: string
          format: date-time
        receipt:
          type: object
          additionalProperties: true
  examples:
    ListTransactionsResponse:
      value:
        status: success
        message: Transactions fetched
        data:
          transactions:
            - id: dep-uuid-001
              kind: payment_route
              customerId: a1b2c3d4-e5f6-7890-abcd-ef1234567890
              customerName: Acme Ltd
              status: success
              destination: Base · USDC → 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb
              amount: 250 USDT
              amountUsd: '250.00'
              createdAt: '2026-06-26T11:00:00.000Z'
              receipt:
                type: payment_route_deposit
                depositId: dep-uuid-001
                relayRequestId: req_abc123
                routeId: route-uuid-001
                routeName: Supplier collection
                status: success
                origin:
                  network: Tron
                  symbol: USDT
                  amount: '250'
                  amountUsd: '250.00'
                destination:
                  network: Base
                  symbol: USDC
                  address: '0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb'
                  amount: '250'
                  amountUsd: '250.00'
                depositTxHash: '0xabc123def4567890'
          total: 1
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      description: >
        API key created in the Remitflex Dashboard at dashboard.remitflex.io
        (`rmf_live_...` or `rmf_test_...`).

        Key management endpoints require a dashboard JWT and are not part of
        this reference.

````