Docs
/
FFL Monkey

docs.fflmonkey.com/api-key. For the whole Data Feed API as one document, use Print or save as PDF at the foot of the docs menu.

Docs / Create an API key

For Data Feed and FFL Checkout stores
Start here · one minute in your account

Create an API key

Your point of sale, website or script proves who it is with a key. You make one in your FFL Monkey account.

Every licence can have API keys

You can create API keys for any FFL Monkey licence, whichever product it is for and whichever platform your website runs on. That includes a licence you use with our WordPress plugin: you do not need a second licence or a different plan, and your keys work alongside the plugin.

The licence's product decides what a key can reach: the permissions are listed below. The licence has to be active for a key to read or change your website's data; until then those endpoints answer 403 license_not_active. On a website running the Data Feed plugin, the plugin manages the webhook, so a key can read it but cannot change it. See Webhooks.

1Open API keys

Sign in to your FFL Monkey account at https://backend.fflmonkey.com/dashboard/api-keys, the account you bought your licence with, and choose API keys in the menu. Keys are made there, not in wp-admin: an up-to-date plugin has no API keys tab, and a link to the old one points to your account.

  1. Your FFL Monkey account
  2. API keys
  3. Create API key

2Choose its store, name it and choose its access

Choose Create API key. A key belongs to one store: pick it under Store if your account has more than one. Give it a name you will recognise later, for example "Lightspeed POS" or "Inventory script". Then give it a permission for each area of your store, from No access, Read and, where there is something to change, Read and write. A Data Feed store's key can be given:

  • In-house inventory, for the Inventory API: Read and write for anything that changes your in-house stock or prices, Read for reports and dashboards, which cannot change anything.
  • Products and changes, for the Store API: Read to read your products at your prices, the category tree, the brands and product classes, and what changed.
  • Pricing rules: Read to read your pricing rules and store-wide pricing settings, Read and write to create, change, reorder, delete and preview rules and to change the settings. See Rules and restrictions.
  • Restrictions: Read to read your restrictions, Read and write to create, change, delete and preview them.
  • Distributors: Read to see which distributors you buy from and whether your credentials were accepted, and to work out how to buy an order from them, Read and write to connect and disconnect them. A key with Read and write can also switch a distributor off, so its offers stop being priced for your store: give it only to a system you trust with that.
  • Webhook: Read to see where your store's changes are sent, Read and write to set that URL, test it and remove it. A key with Read and write decides where all your store's changes go, so give it only to a system you trust with them. See Webhooks.
  • Subscription: Read to see your FFL Monkey subscription, and get a link to pay from when it will not renew.

An FFL Checkout store's key can be given Webhook and Subscription too, and these two:

  • FFL dealers: Read to find the licensed dealers a firearm may be sent to and check a licence. See FFL Checkout.
  • FFL orders: Read to read the FFL orders you reported and the licences you uploaded, Read and write to report the dealer a buyer chose, the transfer as you run it and that it happened, and to upload the licence of a dealer the registry does not have.

A key can do only what it is given, and needs at least one permission. Create one key per system, so you can revoke one without breaking the others. A store running both products holds two licences: make a key on each.

3Copy it straight away

Shown once
ffl_sk_live_3f9a…

An example. A real key is ffl_sk_live_ followed by 49 letters and digits.

It is shown once. We store only a fingerprint of it, so it cannot be shown again. If you lose it, revoke it and create another.

Keep it safe

Good to know

  • A store can have up to 10 active keys. Create one per system, so you can revoke one without breaking the others.
  • Revoking a key stops it working on its next request. Revoke one on the API keys page; FFL Monkey support can revoke a leaked key for you too, and never makes one.
  • The list shows when each key was last used.

Keep the key on a server

It is a secret that can change your store's stock and prices. Use it from your own server or a script, and never in a web page or browser code. The API does not answer browsers' cross-origin requests, on purpose.

Then test it

Send the key in the Authorization header of every request. Keys start with ffl_sk_live_ followed by 49 letters and digits. A key belongs to one store and can only see and change that store's rows.

GET /key is the "test connection" call. Run it with your real key on your server. A key without In-house inventory tests itself with the Store API's GET /key, which any key can call and which lists its permissions.

See GET /key →

FFL Monkey API, version 1. Questions: Support in your FFL Monkey account, or [email protected].