Authenticate public API requests with an organization API key.
Header
Send the key as a bearer token:
Authorization: Bearer cfk_your_api_keyMost endpoints also accept the key in either of these headers:
X-API-Key: cfk_your_api_key
X-Organization-API-Key: cfk_your_api_key/market-availability accepts only Authorization: Bearer.
Organization API keys always start with cfk_. A Bearer token that does not start with cfk_ is treated as a user session token, not an API key, and is never looked up as a key.
Generate a Key
In Cloudflow, open Settings > API Access. API access is available to organizations on the Business and Enterprise plans.
Who can manage keys
Generating and revoking a key requires the organization:manage:integrations permission on the organization. Users without it receive a 403 response.
Key Lifecycle
- Each organization has one API key at a time.
- Keys are
cfk_followed by 64 hexadecimal characters. - Generating a new key immediately invalidates the previous key. Update your integrations before or right after regenerating.
- Revoking a key removes it. Requests that use it return
401. - Cloudflow records the last used time of the key each time it authenticates a request. Calls to
/market-availabilitydo not update it.
Organization Scope
API keys are scoped to the organization that generated the key. Cloudflow determines the organization from the key, so you do not need to send an organization ID.
If you do send an organizationId query or body value and it does not match the key's organization, the request fails with 403:
{ "error": "Access denied to this organization" }Security
Store API keys server-side. Do not commit them to source control, expose them in browser JavaScript, or share them in screenshots. Rotate or revoke keys when an integration owner changes.