Sessions, merchants, orders, wallets. A prepaid platform in five nouns.

The Flex API is a JSON-over-HTTPS API. Every request needs an x-cc-app header identifying your integration and a bearer token obtained from a session. Everything else is nouns: merchants to browse catalog and inventory, orders to purchase, and wallets to retrieve delivered card data.

• Sandbox — https://sandbox-api.flexprepaid.com/v3(sandbox access is provisioned by sales)
• Production — https://production-api.flexprepaid.com/v3

Send your x-cc-app header on every request. Exchange your API key at POST /session for a short-lived bearer token, then pass it as Authorization: Bearer <token> on subsequent calls.

curl -X POST https://sandbox-api.flexprepaid.com/v3/session \
  -H "x-cc-app: your-app-id" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "sk_test_..."}'

Response returns a token, its expiry, and your account context. Refresh before expiry — expired tokens return 401.

Discover the brands you can order and their available denominations and formats.

# List merchants you can buy
curl https://sandbox-api.flexprepaid.com/v3/merchants/buy/bulk \
  -H "x-cc-app: your-app-id" \
  -H "Authorization: Bearer $TOKEN"

# Fetch live inventory for a merchant
curl https://sandbox-api.flexprepaid.com/v3/merchants/{merchant_id}/inventory/bulk \
  -H "x-cc-app: your-app-id" \
  -H "Authorization: Bearer $TOKEN"

Inventory reflects real-time availability across the Flex sourcing network. If a denomination isn't returned, we don't have it available at that moment.

Place an order with a condensed checkout payload. Orders are idempotent when you provide your own reference — retries are safe.

curl -X POST "https://sandbox-api.flexprepaid.com/v3/orders?checkout=condensed" \
  -H "x-cc-app: your-app-id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "reference": "your-idempotency-key",
    "items": [
      { "merchant_id": "amazon", "denomination": 50, "quantity": 1 }
    ],
    "delivery": { "method": "wallet" }
  }'

The response includes an order id and per-line wallet ids you can use to fetch card data once delivery completes.

Card data (numbers, PINs, redemption URLs) is held in wallets. List them, or fetch secure data for a specific wallet when you're ready to deliver it to your end user.

# List wallets
curl https://sandbox-api.flexprepaid.com/v3/wallets \
  -H "x-cc-app: your-app-id" \
  -H "Authorization: Bearer $TOKEN"

# Retrieve secure card data
curl https://sandbox-api.flexprepaid.com/v3/wallets/{id}/secure-data \
  -H "x-cc-app: your-app-id" \
  -H "Authorization: Bearer $TOKEN"

Secure-data requests are audited. Only expose these values to end users through server-side channels — never log them.

Subscribe to lifecycle events (order placed, order delivered, wallet ready) and Flex will POST them to your endpoint with an HMAC-SHA256 signature over the raw body. Verify the signature before trusting the payload.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyFlexSignature(rawBody: string, signature: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

• 401 — missing or expired bearer token. Re-authenticate with POST /session.
• 409 — order reference already used. Safe to treat as a successful duplicate.
• 429 — rate limited. Retry with exponential backoff and honor the Retry-After header.
• 5xx — transient. Retries with the same reference are safe.

The API is plain JSON over HTTPS, so any HTTP client works — no SDK is required. For language-specific integration help, email developers@flexprepaid.com.