Keys

Check which app and environment a key belongs to, before you send anything with it.

Check a key

GET/v1/whoami

Which app and environment the key you signed with belongs to. Nothing is stored, so it is the request to test a connection with: a 401 says whether the key, the secret or the clock is wrong.

AuthSigned request with an app key, fg_live_… or fg_test_…

Returns · 200

appobjectrequired

The app the key belongs to.

Child attributes

idstringrequireduuid

namestringrequired

environmentstringrequired

sandbox for a test key (fg_test_…), production for a production key (fg_live_…).

One of production sandbox

keyIdstringrequired

The key id the request was signed with.

Errors

401missing_signature: One of x-fg-key, x-fg-timestamp and x-fg-signature is missing.
401invalid_timestamp: x-fg-timestamp is not Unix time in seconds.
401stale_timestamp: x-fg-timestamp is more than 300 seconds from the server clock. Sign each attempt again, and keep your clock in sync.
401invalid_key: The key id is unknown or revoked, or the app is archived.
401invalid_signature: The signature does not match. Sign the exact bytes you send.
429too_many_attempts: Too many requests with this key in the last minute. Wait Retry-After seconds.

Request

TS=$(date +%s)
SIG=$(printf '%s.' "$TS" | openssl dgst -sha256 -hmac "$FG_SECRET" | sed 's/^.*= //')

curl "https://api.affiliate.yflow.io/v1/whoami" \
  -H "x-fg-key: $FG_KEY_ID" \
  -H "x-fg-timestamp: $TS" \
  -H "x-fg-signature: $SIG"

import { createFlowGrowth } from '@flow/growth-sdk';

const fg = createFlowGrowth({
  baseUrl: 'https://api.affiliate.yflow.io',
  keyId: process.env.FG_KEY_ID!, // fg_test_… in the sandbox
  secret: process.env.FG_SECRET!,
});

const res = await fg.whoami();
if (res.ok) console.log(res.data.app.name, res.data.environment); // 'sandbox' for a fg_test_ key

200 OK

{
  "app": {
    "id": "0c9e6f3a-1b2d-4c5e-8f7a-9b0c1d2e3f4a",
    "name": "Example Shop"
  },
  "environment": "sandbox",
  "keyId": "fg_test_k7qxa2mpw"
}

Check a key#

Check a key