Authentication

Flowziac uses API keys for server-to-server authentication.

Creating API keys

1. Sign in to the Flowziac dashboard
2. Navigate to Settings → API keys
3. Click Generate key
4. Copy your apiKey and apiSecret immediately

⚠️ The apiSecret is shown only once. Store it securely in an environment variable — never in client-side code or public repositories.

Using API keys

Include these headers on every request to the public API:

apiKeyorX-API-KeyPublic key (starts with pk_)

apiSecretorX-API-SecretSecret value

Example request

HTTP

POST /api/v1/public/messages/send HTTP/1.1
Host: your-domain.com
Content-Type: application/json
apiKey: pk_your_key_id
apiSecret: your_secret

{
  "type": "text",
  "phone": "919876543210",
  "content": "Hello!"
}

Key management

• You can create multiple API keys per workspace (e.g. staging vs production)

• Revoked keys stop working immediately

• Rotate keys periodically for security

• API keys are scoped to a workspace — they can only access resources within that workspace

Security best practices

✓

Store secrets in environment variables or a secrets manager (e.g. AWS Secrets Manager, HashiCorp Vault)

✓

Never expose apiSecret in client-side code, mobile apps, or public repositories

✓

Use HTTPS only in production

✓

Rotate keys every 90 days

✓

Monitor API usage in the dashboard for unusual activity