# FAQ

## Integration

### Which flows should be tested before go-live?

Test both Money Out and Money In.

Money Out validates outbound payment creation, idempotency, status updates, and
report reconciliation. Money In validates inbound event processing, acceptance or
rejection behavior, deduplication, and report reconciliation.

Start with [Integration Path](/products/fincore/guides/integration-path), then validate:

- [Create Money Out transaction](/products/fincore/guides/money-out#create-money-out-transaction)
- [Money In webhook event](/products/fincore/guides/money-in#money-in-webhook-event)
- [Status update webhook event](/products/fincore/guides/webhooks#status-update-webhook-event)
- [Download a report file](/products/fincore/guides/reports#download-report-file)


### Is Money In initiated by the merchant?

No. Money In is inbound. It is triggered when funds arrive into a Monato account,
usually from an external SPEI deposit or an internal Monato credit.

Even though your system does not initiate it, Money In is a core integration
flow. Your system must persist the event, deduplicate it, classify the origin,
return the expected HTTP status, and reconcile it later.

See [Money In](/products/fincore/guides/money-in).

### What is the recommended integration order?

Use this order:

1. Authenticate.
2. Retrieve accounts and catalogs.
3. Configure webhooks.
4. Register destination instruments.
5. Send and reconcile Money Out.
6. Receive and reconcile Money In.
7. Validate reports and error handling.


See [Overview](/products/fincore/guides/overview) and [Integration Path](/products/fincore/guides/integration-path).

## Authentication

### Why can a request return 401?

A `401` usually means the request is missing valid credentials for the target
environment.

For bootstrap calls, verify `x-api-key`. For protected operations, verify
`Authorization: Bearer <token>`. If the token may be expired, create a new one
and retry once.

See [Authentication](/products/fincore/guides/authentication) and [Error Handling](/products/fincore/guides/error-catalog).

### Should I use `x-api-key` or `Authorization`?

Use `x-api-key` only for the bootstrap authentication operations:

- [Retrieve client credentials](/products/fincore/guides/authentication#retrieve-client-credentials)
- [Create authentication token](/products/fincore/guides/authentication#create-authentication-token)


Use `Authorization: Bearer <token>` for protected Fincore operations.

### What should I do when a bearer token expires?

Create a new token with
[Create authentication token](/products/fincore/guides/authentication#create-authentication-token) and retry
once. If the new token also fails, verify that the client, credential, token, and
environment match.

## Webhooks

### Which webhooks should I configure?

Configure the webhook types required by your product flow:

| Webhook | Use |
|  --- | --- |
| `MONEY_IN` | Incoming SPEI or internal credit events. |
| `STATUS_UPDATE` | Final or updated Money Out transaction status. |
| `CEP` | Penny Validation result. |
| `REPORT` | Generated report file availability. |


See [Webhooks](/products/fincore/guides/webhooks).

### Can I reject a Money In?

For external SPEI Money In, yes. Return `422` with the documented rejection body
when your business validation rejects the deposit.

For internal Monato credits, funds have already moved by the time the webhook is
delivered; your HTTP response does not reverse the movement.

See [Money In webhook event](/products/fincore/guides/money-in#money-in-webhook-event).

### How should I handle duplicate webhook delivery?

Use the webhook message identifier for deduplication and return a successful
status when the event was already processed correctly.

Never rely only on delivery order. Store the transaction ID and tracking key for
reconciliation.

## Money Out

### When should I send an `Idempotency-Key`?

Send an `Idempotency-Key` for Money Out and Penny Validation requests that may be
retried.

Use a deterministic UUID v5 for retries of the same business operation. Reusing
a key for a different operation can create a conflict.

See [Idempotency](/products/fincore/guides/idempotency).

### Does the Money Out response mean the payment is final?

No. The synchronous response means Fincore accepted the request. Final state is
asynchronous and arrives through status webhooks and reports.

See [Money Out](/products/fincore/guides/money-out).

## Reconciliation

### What should I store for reconciliation?

Store IDs and operational references, not sensitive payloads:

- Monato transaction ID.
- `trackingId` or `tracking_key`.
- Webhook message ID.
- `client_id`.
- Operation status.
- Report file name when available.


Do not log full CLABEs, card numbers, API keys, secrets, or personally
identifiable information.

### Where do endpoint-specific errors live?

Each operation page includes its own response table. Use
[Error Handling](/products/fincore/guides/error-catalog) only for shared error format and cross-cutting
rules.