Authentication

curl https://my.flowsign.app/api/v1/workspaces \
  -H "Authorization: Bearer fsk_your_key_here"

const res = await fetch("https://my.flowsign.app/api/v1/workspaces", {
  headers: { Authorization: `Bearer ${process.env.FLOWSIGN_API_KEY}` },
});

const { data } = await res.json();
console.log(data.active, data.workspaces);

import os

import requests

res = requests.get(
    "https://my.flowsign.app/api/v1/workspaces",
    headers={"Authorization": f"Bearer {os.environ['FLOWSIGN_API_KEY']}"},
    timeout=30,
)
res.raise_for_status()

data = res.json()["data"]
print(data["active"], data["workspaces"])

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;

using var http = new HttpClient { BaseAddress = new Uri("https://my.flowsign.app") };
http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
    "Bearer",
    Environment.GetEnvironmentVariable("FLOWSIGN_API_KEY"));

var body = await http.GetFromJsonAsync<JsonElement>("/api/v1/workspaces");
var data = body.GetProperty("data");

Console.WriteLine(data.GetProperty("active").GetString());

​

Creating and managing keys

• Name the key after where it will live (for example “Production server”).
• Expiry is optional. A key with no expiry works until you revoke it; a key with an expiry stops working at the end of that day.
• The key value is displayed once in a reveal dialog and cannot be read again. If you lose it, create a new key.
• Revoke a key from the same page. Revocation is immediate and permanent.
• There is no rotate operation. To rotate, create a new key, move your integration to it, then revoke the old one.

​

Who can use the API

• Permission. Creating and using keys requires the API access permission on the user’s profile. The built-in Admin profile has it; Sender and Viewer do not. An administrator can grant it from Roles & Permissions.
• Acting as a user. A key acts as its creator. Endpoints that change data check that user’s permissions, so a key created by someone without the send permission cannot send packages (403 Missing permission: canSendPackages).
• Webhook endpoints (/api/v1/webhooks) additionally require the user to be an organisation admin.
• Plan. The public API is included in the Enterprise plan. Webhooks are a separate feature on the same plan. Calls from organisations without the feature return 402.
• IP allowlist. If your organisation has an IP allowlist (Settings > Security), API calls from other addresses are refused with 403 IP address not allowed.

​

Workspaces

​

Why a request is refused