FloPay Backend Changelog

v1.7.26 - Client-scoped checkout link administration #

Authorized operators can now manage checkout links for one explicitly selected client without changing merchant-facing checkout APIs.

Authorized Flo operators can now create, list, retrieve, update, and deactivate checkout links on behalf of one explicitly selected client. Existing merchant-managed checkout links and buyer-facing link resolution continue to work without changes.

What changed

• The operator API now provides GET, POST, PATCH, and DELETE routes under /v1/admin/checkout-links, including single-link operations at /v1/admin/checkout-links/:uuid.
• Every operator request requires one valid clientId, keeping reads and changes restricted to the selected client.
• List requests use the same pagination, filtering, searching, and sorting contract as GET /v1/checkout-links.
• Read-only admin credentials can use the GET routes, while write credentials can create, update, and deactivate links. The legacy admin scope remains supported for all operations.

Why it matters

• Authorized operators can assist merchants with checkout-link management without switching client credentials.
• Explicit client selection prevents an operation from falling back to another client or returning an all-client list.

Developer notes

• Operator integrations must include exactly one clientId query parameter on every admin checkout-link request.
• The admin routes are intentionally omitted from the generated OpenAPI specification.
• Existing /v1/checkout-links management and resolve contracts are unchanged. No SDK update, payload migration, merchant configuration, or operational action is required, and this release contains no breaking changes.