Skip to main content

Authentication with API Key

Overview​

Access to the Public API is authenticated using an API Key. The API Key is a permanent secret key issued upon integration registration. It allows you to obtain a temporary JWT token for making API requests.

API Key format: fk_live_<64 characters> Example: fk_live_aceca96f64ebd6aad6246cfa9380fb6a0f02c7a8bfe96785538c196e8661add8

The fk_live_ prefix indicates a production environment. Test environments use the fk_test_ prefix.

Obtaining a JWT Token​

To obtain a token, send a POST request with your API Key:

POST /api/v1/auth/tokens
Content-Type: application/json

{
  "api_key": "fk_live_aceca96f64ebd6aad6246cfa9380fb6a0f02c7a8bfe96785538c196e8661add8"
}

A successful response returns:

{
  "access_token": "<JWT>",
  "expires_in": 3600,
  "refresh_token": "<refresh_token>",
  "token_type": "Bearer"
}
  • access_token — JWT token for accessing the API
  • expires_in — token lifetime in seconds (3600 seconds = 1 hour)
  • refresh_token — token used to obtain a new access_token without providing the API Key again

Refreshing a Token​

When the access_token expires, use the refresh_token to obtain a new one:

POST /api/v1/auth/tokens/refresh
Content-Type: application/json

{
  "refresh_token": "<refresh_token>"
}

Using the Token​

Include the access_token in the Authorization header with every request to the Public API:

Authorization: Bearer <access_token>

Notes​

  • Public API tokens and product user tokens are not interchangeable. Public API routes require tokens obtained via API Key authentication.
  • A Public API client is always bound to a single company and a single role.