API Keys
All API requests require authentication via an API key. Include your key in the Authorization header as a Bearer token:
curl https://data.craftflow.co/api/v1/users/ \
-H "Authorization: Bearer cf_live_your_api_key_here"Getting Your API Key
You can generate API keys directly from the Craft web app:
Go to Company Settings
Log in at app.craftflow.co and navigate to Company Settings from the sidebar.
Open the API Keys tab
Click the API Keys tab.
Create a new key
Click Create API Key, give it a descriptive name (e.g., “Production Integration”), and optionally set an expiration date. Click Create key.
Copy your key
Your API key will be displayed once. Copy it immediately and store it somewhere secure — you will not be able to see it again.
Who can manage API keys?
Only users with Full Admin or Super Admin permissions can create, rename, and revoke API keys. If you don’t see the API Keys tab, ask an admin on your team to generate one for you.
Key details
- API keys are scoped to your company. All requests made with a key will only return data belonging to your company.
- You can revoke a key at any time from the API Keys tab. Revoked keys stop working immediately.
- Optionally set an expiration date when creating a key. Keys with no expiration date remain valid until manually revoked.
API keys are prefixed with cf_live_ so they’re easy to identify. Never commit them to source control or share them publicly.
Error Responses
| Status Code | Description |
|---|---|
401 Unauthorized | Missing or invalid API key. |
403 Forbidden | The API key doesn’t have permission for this action. |
429 Too Many Requests | Rate limit exceeded. Wait and retry. |
Example: Invalid API key
{
"error": {
"detail": "Invalid API key."
}
}Example: Expired API key
{
"error": {
"detail": "API key has expired."
}
}