> ## Documentation Index
> Fetch the complete documentation index at: https://developers.xfaster.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys per store, integrator keys and webhook secrets.

Every call carries the store's API key as a bearer token:

```bash theme={null}
curl https://staging2.xfaster.net/api/partner/v1/store \
  -H "Authorization: Bearer xfp_test_…"
```

* **One key per store (location).** A chain with five branches has five keys.
* **Live and test keys:** `xfp_live_…` works only on `apps.xfaster.net`, `xfp_test_…` only on the sandbox. A key on the wrong server gets `401 wrong_environment`.
* **XFaster issues the key** from the store's page in the XFaster admin and shows it once. Only a hash is stored, so a lost key is replaced, not recovered.
* **Revoking** disconnects the POS at once. Calls get `401`.

## Integrator keys

A POS company that serves many XFaster stores can work with **one integrator key** instead of a key per store. Every call then names the store in the `X-XFaster-Store` header:

```bash theme={null}
curl https://staging2.xfaster.net/api/partner/v1/orders \
  -H "Authorization: Bearer xfp_test_…" \
  -H "X-XFaster-Store: 64"
```

* XFaster **links each store** to your key, on the store owner's request. Everything else works as with a store key, scoped to the store you name.
* Without the header: `400 store_header_required`. A store that is not linked to your key: `403 store_not_linked`.
* Webhooks for every linked store go to your key's endpoint. The payload's `store_id` says which store.
* **300 requests per minute** for the whole key.
* `Idempotency-Key` values belong to the key: make them unique across your stores (a UUID is fine).
* Unlinking a store stops the key for that store only.

## Webhook secret

Each key also has a **webhook secret** (`whsec_…`). XFaster signs every webhook with it. You never send it back. See [Webhooks](/basics/webhooks).

<Warning>
  Keep keys on your server. Never in a browser, a mobile app or a URL, and only over HTTPS.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.