Skip to main content
Every call carries the store’s API key as a bearer token:
  • One key per store (location). A chain with five branches has five keys.
  • Live and test keys: xfp_live_… works only on apps.xfaster.net, xfp_test_… only on the sandbox. A key on the wrong server gets 401 wrong_environment.
  • XFaster issues the key from the store’s page in the XFaster admin and shows it once. Only a hash is stored, so a lost key is replaced, not recovered.
  • Revoking disconnects the POS at once. Calls get 401.

​
Integrator keys

A POS company that serves many XFaster stores can work with one integrator key instead of a key per store. Every call then names the store in the X-XFaster-Store header:
  • XFaster links each store to your key, on the store owner’s request. Everything else works as with a store key, scoped to the store you name.
  • Without the header: 400 store_header_required. A store that is not linked to your key: 403 store_not_linked.
  • Webhooks for every linked store go to your key’s endpoint. The payload’s store_id says which store.
  • 300 requests per minute for the whole key.
  • Idempotency-Key values belong to the key: make them unique across your stores (a UUID is fine).
  • Unlinking a store stops the key for that store only.

​
Webhook secret

Each key also has a webhook secret (whsec_…). XFaster signs every webhook with it. You never send it back. See Webhooks.
Keep keys on your server. Never in a browser, a mobile app or a URL, and only over HTTPS.