Skip to content

Flutterwave

Service Name: Flutterwave

Service Description: Flutterwave is a fintech company that provides payment infrastructure for global merchants and payment service providers across Africa. It enables businesses to process payments via multiple channels including cards, mobile money, bank transfers, and more.

Service Address: https://flutterwave.com

  • Validation Type: -
  • IP Allow list: Does not exist
  • Secret Access Scope: Grants access to Flutterwave payment processing API,

allowing transactions, customer management, and payment operations.

  • Secret Revokement URL:

https://dashboard.flutterwave.com/dashboard/settings/apis

  • Secret Example: FLWSECK-1234567890abcdef1234567890abcdef-X
  • Suspicious Activity Investigation Instructions:
  • Review transaction logs in the Flutterwave dashboard for unauthorized

payments

  • Check for unusual transaction patterns or volumes
  • Monitor for transactions from unexpected geographic locations
  • Verify webhook configurations for unauthorized changes
  • Examine API call logs for unusual endpoints or request patterns
  • Mitigation Instructions:
  • Immediately revoke the compromised API key from the Flutterwave

dashboard

Flutterwave API Key

  • Generate a new API key with appropriate permissions
  • Update the API key in all legitimate applications
  • Implement IP whitelisting for API access if available
  • Review and update security policies for handling API keys
  • Enable additional security features like webhook signatures