| Connections |
Every page and API call is served over HTTPS |
| API keys |
A key is shown once, when it is created. FlightAPI stores only a one-way hash of it. Sandbox keys start with sk_test_ and live keys with sk_live_. Keys can be rotated or revoked in the developer portal at any time, and every key action is recorded |
| Sign-in |
No passwords. Sign-in uses a one-time email code, Google or Apple. A code expires after a short time, works once and is blocked after repeated wrong attempts |
| Card payments |
Cards are handled by Airwallex. FlightAPI does not receive or store card numbers |
| Webhooks |
Every webhook is signed with HMAC-SHA256 so your server can check that it came from FlightAPI |
| Rate limits |
Each key has a limit per minute and per day; the remaining calls are returned on every response |
| Administration |
Administrators sign in separately from customers, and every administrative action on an account is recorded |
| Availability |
Current status and 90-day uptime are published on the status page |