Try the Fipto API in two minutes with our public Postman collection. Includes pre-built RSA-SHA256 signing scripts and ready-to-run requests against the demo environment.
The fastest way to try the Fipto API end-to-end is with our public Postman collection. It includes pre-built RSA-SHA256 signing scripts and runnable requests against the demo environment, so you can send your first signed request in under two minutes.
Quick facts
- Signing: Bundled pre-request script signs every request with your private key
- Environment: boilerplate demo environment (
api.demo.fipto.tech) ready to fork- Auth scheme: RSA-SHA256 HTTP Signatures (
hs2019)
Prerequisites
- A Fipto account in demo or production. See Get started with Fipto.
-
An RSA private key (
private-key.pem) and the Key ID of your API integration. See Authenticate with the Fipto API. -
Postman installed.
Overview
Postman is a user-friendly app that helps people work with APIs, whether you're an experienced developer or new to coding. It makes it easy to see our available endpoints and test APIs before writing any code.
It is especially useful as it will directly generate Authorization header in the request thanks to a pre-script that we implemented in the Postman collection.
Setup Postman
- Download Postman or use their web client.
- Fork this collection to your workspace.
Set environment variable
We made a boilerplate environment to get you started. You need to fork it to add it to the workspace where you forked the API collection. You will then be able to select it on the top right of the screen (see below).
Once you have forked it, fill in the following variables:
| Variable | Value |
|---|---|
company-id | The ID of the company created for you, provided during onboarding |
key-id | The Key ID of your API integration (Settings > API integrations in the Fipto app) |
private-key | The private key matching the public key registered in your API integration. For your safety, never reuse a key that you use, or will use, in production |
The environment and baseUrl values are already set in the boilerplate environment and do not need to be changed.
Run a request
Open a request such as Get wallets, add your {{company-id}} variable in the path where needed, and click Send. The pre-request script generates the Date, optional Digest and the Signature headers on the fly. You should receive a 200 response with the list of wallets visible to your account.
How the signing script works
The pre-request script does four things, in order:
- Sets the
Dateheader to the current time in RFC 1123 format. - For requests with a body, computes the base64-encoded SHA-256 digest of the body and sets the
Digestheader. - Builds the signing string in the order
(request-target),host,date, thencontent-typeanddigestwhen present. - Signs the string with the RSA private key using SHA-256 and writes the final
Signatureheader.
The same logic, written for a backend, is documented in Authenticate with the Fipto API.
Common errors
| Error | Cause | Fix |
|---|---|---|
| 401 Unauthorized | private-key variable does not include the BEGIN/END lines or newlines were lost | Re-paste the key, keeping the exact PEM formatting |
| 401 Unauthorized | key-id does not match your API integration | Check the Key ID in Settings > API integrations |
| 401 Unauthorized | Date drift on the machine running Postman | Sync the system clock |
Frequently asked questions
Where do I find the public Postman collection?
It is linked in the Setup Postman section above. Fork it into your own workspace, together with the boilerplate environment.
Can I use Insomnia or another HTTP client?
Yes. Any client that supports a pre-request hook can sign Fipto requests. The Postman script can be adapted to Insomnia, Bruno or your own CLI.
Do I need to install anything to make the signing script work?
No. Postman ships with the crypto primitives the script uses.