Authentication

Authenticated endpoints require an API key passed via the Authorization header. Public endpoints (detect, formats) do not require authentication.

Bearer Token

Pass your API key in the Authorization header. Both the Bearer prefix and plain key formats are accepted.

Header Format Example
Authorization: Bearer <key> Bearer fc_live_abc123...
Authorization: <key> fc_live_abc123...
Authenticated request
curl -X POST https://api.finconvert.dev/v1/parse \
  -H "Authorization: Bearer fc_live_xxxxx" \  # Your API key
  -F "file=@bank-statement.mt940"              # Upload a local file

API Key Prefixes

FinConvert uses prefixed API keys to distinguish between production and sandbox environments.

Prefix Environment Usage
fc_live_ Production Live conversions, counted toward billing quota
fc_test_ Sandbox Testing and development, separate rate limits and quotas

Test vs Live Environments

Both key types hit the same API endpoint and produce real conversions. The difference is in how usage is tracked:

  • Live keys — Usage counts toward your monthly billing quota. Rate limits depend on your plan.
  • Test keys — Usage is tracked separately with a fixed limit of 200 conversions/month and 30 requests/60 seconds, regardless of your plan.

Same API, same results

Test keys produce the exact same conversion output as live keys. Use them during development and in your CI/CD pipeline without worrying about billing.

Security Best Practices

Keep your API keys secret

Never expose API keys in client-side code, public repositories, or browser network requests. API keys should only be used in server-side code.
  • Store API keys in environment variables or a secrets manager
  • Rotate keys immediately if you suspect they have been compromised
  • Use test keys during development to avoid accidental billing charges
  • Generate separate keys for different services or environments

Ready to get started?

Get your API key from the dashboard and start converting bank statements.

Go to Dashboard