API keys
Authenticate server-side requests to the Flowtag API.
Not to be confused with Variable tokens
What is an API key?
API keys authenticate requests from your servers to the Flowtag management API.
The management API is still limited — today it covers data subjects only: listing them, reading what is stored about one, and erasing it. Endpoints for trackers, monitors, and status pages are not exposed yet. To read remote config values, use a variable token against the Variables API instead.
API keys act on behalf of your organisation. Keep them secret and out of client-side code.
Creating an API key
- Go to Settings -> API Keys in the Dashboard.
- Click New API key and enter a name.
- Select the scopes the key should have (see below).
- Copy the key string — it is shown only once.
Scopes
A key can only call endpoints covered by the scopes you grant it, so give each integration its own key with the narrowest set that works. Scopes are grouped by product area — Analytics, Trackers, Variables, Uptime Monitors, Status Pages, Members, API Keys, and Billing — and each endpoint in the API reference states the scope it requires.
Scopes are named area:action, for example analytics:view to read collected
analytics data, or analytics:delete-data to erase a data subject's records.
analytics:delete-data permanently deletes collected data and cannot be undone. Grant it only to integrations that handle erasure requests.
Using an API key
Send the key as a bearer token:
curl https://api.flowtag.dev/v1/analytics/trackers/trk_123/subjects \
-H "Authorization: Bearer ft_yourPublicKey.yourSecret"Rotating an API key
Rotation generates a new key string immediately. The old string stops working as soon as you confirm.
- Open the key's options menu (...).
- Click Rotate and confirm.
- Update the key in all services that use it.
Revoking an API key
- Open the key's options menu (...).
- Click Revoke.
- Type the key name to confirm and click Revoke.