Authentication

Cloudflow public API requests use organization API keys.

Authorization Header

Include the key in the Authorization header:

Authorization: Bearer cfk_your_api_key

Every request should be made over HTTPS to the Cloudflow API base URL:

https://app.cloudflowtechnology.com/api

Generate a Key

In Cloudflow, open Settings > API Access and create an API key for the organization you want the integration to access.

API access is currently available to Business plan organizations in the app.

Organization Scope

API keys are scoped to the organization that generated them. When a request uses Authorization: Bearer cfk_..., Cloudflow determines the organization from the key.

The organizationId query or body field is mainly for session-authenticated app requests and test paths. Avoid depending on it for normal public API-key integrations.

Key Handling

• Store keys server-side.
• Do not commit keys to source control.
• Do not expose keys in browser JavaScript or public mobile clients.
• Rotate or revoke keys when an integration owner changes or when exposure is suspected.
• Use separate keys for separate integration owners when possible.

Cloudflow examples use cfk_your_api_key as a sample token, not a real credential.