Authentication

The Fyralynx API uses API key authentication via the standard HTTP Authorization header. This guide covers generating API keys, using them in requests, security best practices, and handling authentication errors.

Plan Requirements

API access is available on Publisher ($39/month) and Enterprise ($299+/month) plans.

Plan	API Access	Rate Limit
Free	None	-
Creator	None	-
Pro	None	-
Publisher	All endpoints except bulk + webhooks	60 req/min
Enterprise	All endpoints including bulk + webhooks + SLA	600 req/min

Attempting to call any API endpoint with a Free, Creator, or Pro tier key returns HTTP 403 with code PUBLISHER_TIER_REQUIRED.

Generating an API Key

Sign in to your Fyralynx account at fyralynx.com/dashboard.
Navigate to Settings → API Keys.
Click "+ New API Key".
Give the key a descriptive name (e.g. wordpress-production, bulk-link-builder).
Click "Generate".
Copy the key immediately - it is shown only once. Fyralynx stores only the bcrypt hash.

You can create multiple API keys per account. Each key can be individually revoked without affecting others - useful for separating production and staging keys, or revoking access from a compromised environment.

Using Your API Key

Include your API key as a Bearer token in every request's Authorization header:

http

Authorization: Bearer flx_live_sk_1234567890abcdefghijklmnopqrstuvwxyz

curl

bash

curl https://api.fyralynx.com/v1/account \
  -H "Authorization: Bearer flx_live_sk_1234567890abcdefghijklmnopqrstuvwxyz"

JavaScript / TypeScript (fetch)

typescript

const response = await fetch('https://api.fyralynx.com/v1/account', {
  headers: {
    'Authorization': `Bearer ${process.env.FYRALYNX_API_KEY}`,
    'Content-Type': 'application/json',
  },
});

if (!response.ok) {
  const error = await response.json();
  throw new Error(`Fyralynx API error: ${error.code} - ${error.message}`);
}

const { data } = await response.json();

Python (httpx / requests)

python

import httpx

client = httpx.Client(
    base_url="https://api.fyralynx.com/v1",
    headers={"Authorization": f"Bearer {FYRALYNX_API_KEY}"},
)

response = client.get("/account")
response.raise_for_status()
account = response.json()["data"]

PHP (WordPress plugin / Composer)

php

$response = wp_remote_get(
    'https://api.fyralynx.com/v1/account',
    [
        'headers' => [
            'Authorization' => 'Bearer ' . get_option('fyralynx_api_key'),
            'Content-Type'  => 'application/json',
        ],
        'timeout' => 10,
    ]
);

if (is_wp_error($response)) {
    // handle error
}

$body = json_decode(wp_remote_retrieve_body($response), true);

API Key Format

Fyralynx API keys follow this format:

flx_{environment}_{type}_{random}

Component	Values	Description
`flx_`	Always `flx_`	Fyralynx namespace prefix. Useful for secret scanning.
`{environment}`	`live` or `test`	`live` keys are billable. `test` keys (Enterprise only) use a sandbox environment.
`{type}`	`sk` (secret key)	Only secret keys are supported in v1.
`{random}`	40 hex characters	Cryptographically random.

Example: flx_live_sk_a9f3b2e4c1d7890abcdef1234567890abcdef1234

Secret scanning: Because keys start with flx_live_sk_, they are automatically detected by GitHub's secret scanning, GitLeaks, TruffleHog, and most CI secret detection tools.

Enterprise IP Allowlisting

Enterprise tier API keys support IP allowlisting. When allowlisting is enabled:

Requests from non-allowlisted IPs receive HTTP 403 with code IP_NOT_ALLOWLISTED.
Allowlisting applies per key - you can have one allowlisted key for production and one unrestricted key for development.
Cloudflare Workers see the client IP after Cloudflare proxy - if your server sits behind another proxy, contact support to configure IP passthrough.

To configure allowlisting:

Go to Settings → API Keys.
Click the key's Edit button.
Add one or more CIDR blocks or individual IPs under IP Restrictions.

Authentication Errors

HTTP Status	Code	Cause	Resolution
`401 Unauthorized`	`UNAUTHORIZED`	Missing or invalid `Authorization` header	Check that the header is present and the key is correct. Keys are case-sensitive.
`401 Unauthorized`	`UNAUTHORIZED`	Key has been revoked	Generate a new key in the dashboard.
`403 Forbidden`	`PUBLISHER_TIER_REQUIRED`	Plan is below Publisher	Upgrade to Publisher or Enterprise at fyralynx.com/pricing.
`403 Forbidden`	`ENTERPRISE_TIER_REQUIRED`	Action requires Enterprise (e.g. bulk)	Upgrade to Enterprise.
`403 Forbidden`	`IP_NOT_ALLOWLISTED`	Request IP is not in the key's allowlist	Add the IP to the allowlist or use an unrestricted key.

Error Response Format

json

{
  "code": "UNAUTHORIZED",
  "message": "Missing or invalid Bearer token.",
  "requestId": "01HX4Z9Y3ABCDEF1234567890AB"
}

Always log the requestId - include it in any support request.

Security Best Practices

Store keys in environment variables

Never hardcode an API key in source code.

bash

# .env (never commit this file)
FYRALYNX_API_KEY=flx_live_sk_a9f3b2e4c1d7890abcdefghij

typescript

// Load from environment
const apiKey = process.env.FYRALYNX_API_KEY;
if (!apiKey) throw new Error('FYRALYNX_API_KEY is not set');

For serverless environments (Cloudflare Workers, Vercel Edge Functions, AWS Lambda), use the platform's secrets management:

bash

# Cloudflare Workers
wrangler secret put FYRALYNX_API_KEY

# Vercel
vercel env add FYRALYNX_API_KEY

Scope keys to environments

Use separate keys for production and staging/development:

flx_live_sk_... - production only.
Create a test environment key (Enterprise) or use a separate account for staging.

Rotate keys regularly

Rotate keys every 90 days as a security hygiene practice. Fyralynx supports multiple active keys - create the new key, update all consumers, then revoke the old key.

Monitor for key leaks

If you suspect a key has been leaked:

Immediately revoke it at Settings → API Keys → Revoke.
Generate a replacement key.
Check your analytics for unexpected usage patterns.

GitHub will automatically alert you if a Fyralynx key is committed to a public repository (secret scanning integration).

Use IP allowlisting for server-to-server integrations

If your integration runs from a static IP or IP range (e.g. a dedicated server, a Cloudflare Worker with a dedicated egress IP), enable IP allowlisting on your production key. This prevents the key from being usable even if it leaks.

Testing Without Real Clicks

Use POST /v1/route instead of POST /v1/links when you need to test routing decisions without creating persistent links or counting clicks. This is ideal for:

Verifying routing logic during development.
Bulk-checking merchant availability for a country.
Debugging unexpected routing decisions.

bash

curl -X POST https://api.fyralynx.com/v1/route \
  -H "Authorization: Bearer $FYRALYNX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://www.amazon.com/dp/B0CRMZHDG4", "country": "NG", "device": "android"}'

POST /v1/route calls are not click-counted and do not create any persistent resource.

Verifying Your Key Tier

To verify which tier your key is on and check current usage:

bash

curl https://api.fyralynx.com/v1/account \
  -H "Authorization: Bearer $FYRALYNX_API_KEY"

Response:

json

{
  "data": {
    "creatorId": "...",
    "email": "you@example.com",
    "plan": {
      "planId": "publisher",
      "displayName": "Publisher",
      "monthlyPriceUsd": 39,
      "includedClicks": 50000,
      "hasApiAccess": true,
      "hasBulkAccess": false,
      "hasWebhooks": false
    },
    "clicksUsedThisPeriod": 12450,
    "billingPeriodEnd": "2026-06-01",
    "trialActive": false,
    "trialEndsAt": null
  }
}

Authentication ​

Plan Requirements ​

Generating an API Key ​

Using Your API Key ​

curl ​

JavaScript / TypeScript (fetch) ​

Python (httpx / requests) ​

PHP (WordPress plugin / Composer) ​

API Key Format ​

Enterprise IP Allowlisting ​

Authentication Errors ​

Error Response Format ​

Security Best Practices ​

Store keys in environment variables ​

Scope keys to environments ​

Rotate keys regularly ​

Monitor for key leaks ​

Use IP allowlisting for server-to-server integrations ​

Testing Without Real Clicks ​

Verifying Your Key Tier ​

See Also ​

Authentication

Plan Requirements

Generating an API Key

Using Your API Key

curl

JavaScript / TypeScript (fetch)

Python (httpx / requests)

PHP (WordPress plugin / Composer)

API Key Format

Enterprise IP Allowlisting

Authentication Errors

Error Response Format

Security Best Practices

Store keys in environment variables

Scope keys to environments

Rotate keys regularly

Monitor for key leaks

Use IP allowlisting for server-to-server integrations

Testing Without Real Clicks

Verifying Your Key Tier

See Also