API Access

API access allows external systems to read and create selected Cloudflow resources.

Generate an API Key

API keys are managed in Settings > API Access. API access is available on the Business and Enterprise plans.

Only users with the organization:manage:integrations permission can generate or revoke a key.

The key uses the cfk_ prefix followed by 64 hexadecimal characters. Send it as a bearer token:

Authorization: Bearer cfk_your_api_key

You can also send the key in the X-API-Key or X-Organization-API-Key header. Market availability accepts only the bearer form. A bearer token without the cfk_ prefix is treated as a user token, not an API key.

Scope

API keys are organization-scoped. Requests authenticated with an API key operate on the organization that owns the key. Do not send keys from browser code, mobile apps distributed to customers, or public repositories.

Rotate or Revoke

Each organization has one API key. Regenerate a key when you suspect exposure or when handing off integration ownership; the previous key stops working immediately. Revoke a key to immediately stop all applications that depend on it.

Current Public API

The first public API set includes services, customers, statuses, service types, service contacts, and market availability. Internal cron, webhook processor, mobile-only, and provider-specific integration routes are not part of the initial public contract.