Flowcenter API Authentication

Authenticate Flowcenter API requests with scoped bearer tokens, tenant-safe headers, and server-side credential handling.

Use Flowcenter API authentication when

Use this guide when a server, integration, or agent needs to make authorized requests to the Flowcenter REST API. Start with the Flowcenter REST API reference and the Flowcenter OpenAPI specification.

Create a Flowcenter API key

Create a key in your Flowcenter workspace at app.flowcenter.vn under Settings → API Integrations. Use a free or sandbox workspace for testing, keep the key on your server, and rotate or revoke it when access changes.

Send an authenticated request

Send the token as a bearer credential and pin the API version on every request:

Authorization: Bearer YOUR_TOKEN
X-API-Version: 1
Content-Type: application/json

Do not put API keys in browser code, public repositories, client-side URLs, or prompts. Treat them as workspace credentials.

Keep requests tenant-safe

Flowcenter authorizes each key within its workspace. Use the center or tenant context returned by your integration setup, and never reuse a key across unrelated organizations. The public lead-ingestion flow uses a center token; it is separate from staff API authentication.

Handle authentication errors

  • 401: check that the bearer token is present, current, and copied without extra whitespace.
  • 403: check the key’s workspace, role, and endpoint permission.
  • Version errors: send X-API-Version: 1 and inspect the typed error response described in the REST reference.