API keys

Create and manage keys under API Keys in the merchant panel. Every key is scoped to one or more abilities, chosen when the key is created, and can optionally have an expiry date.

Abilities

Ability	Allows
`customers:read`	Retrieve and list customers.
`customers:write`	Create and update customers.
`payments:read`	Retrieve and list payments.
`payments:write`	Create payments.
`payments:refund`	Refund a completed payment.

Requests using a key without the required ability for an endpoint get 403 ability_denied. See Errors for the full list of error codes.

Which ability each endpoint requires

Endpoint	Required ability
`GET /api/v1/customers`	`customers:read`
`GET /api/v1/customers/{id}`	`customers:read`
`POST /api/v1/customers`	`customers:write`
`PATCH /api/v1/customers/{id}`	`customers:write`
`GET /api/v1/payments`	`payments:read`
`GET /api/v1/payments/{id}`	`payments:read`
`POST /api/v1/payments`	`payments:write`
`POST /api/v1/payments/{id}/refund`	`payments:refund`
`GET /api/v1/payments/{id}/refunds`	`payments:read`

A key can hold as many abilities as you need — grant only what the integration actually calls. payments:refund moves money back to the customer, so keep it off keys that only need to create or check payments.

Live vs. test keys

Every key is created in one of two modes, chosen up front — a key can't switch modes later:

Live keys start with fk_live_ and create real payments against your MFS accounts.
Test keys start with fk_test_ and only ever touch test-mode data — see that page for how test payments behave.

A key's mode also scopes what it can see: a test key can never read, list, or refund a live payment, and vice versa, regardless of ability.

Expiry

You can set an optional expiry date when creating a key. Requests with an expired key get 401 authentication_error. Leave it blank for a key that never expires.

Viewing and revoking keys

The full plaintext key is shown only once, right after creation — copy it somewhere safe. Afterwards the merchant panel only ever shows a masked form (e.g. fk_live_ab12345678…9f3a). If a key is compromised or no longer needed, revoke it from the merchant panel; revoked keys stop authenticating immediately and can't be un-revoked — create a new key instead.