Authentication

Every request to the Check API carries an API key of your workspace. Send the key in the Authorization header with the Bearer scheme.

Authorization: Bearer fm_key_xxxxxxxx

• Write the header value as Bearer, one space, and the key.
• An API key starts with fm_key_.
• The Check API reads the key only from the Authorization header. A key in the URL or in the body does not authenticate the request.

To create a key, follow the steps in Quickstart. Only an Owner of the workspace can create or delete keys.

Keep the key on your serverCopy Anchor Link

The Check API sends no CORS headers. A browser blocks every call that a web page makes to the Check API. Call the Check API from your server.

• Store the key in a secret manager or in an environment variable of your server.
• Keep the key out of code that runs on the devices of your users, such as a web page or a mobile app.
• Keep the key out of URLs and logs.

A key works in one regionCopy Anchor Link

A key works only with the API URL of the region where you created it. A request to the API URL of another region gets 401 unauthorized. The Settings page of the console shows the API URL of your workspace.

Every key problem returns the same 401Copy Anchor Link

The Check API answers 401 unauthorized in each of these cases:

• The request has no Authorization header.
• The scheme is not Bearer.
• The value after Bearer is not a Flowmask API key.
• The key does not exist.
• An Owner deleted the key.
• The key belongs to a workspace in another region.
• The workspace of the key no longer exists.

The body is the same in every case, so the response does not say which case applies. Make sure that the key is still on the API keys page, and that the API URL matches the one on the Settings page.

{
  "data": null,
  "code": "unauthorized",
  "message": "Authentication required.",
  "errorId": "FMS401",
  "traceId": "req_01M6JYA42RVG79RDJRM6HYT7P9"
}

The Check API verifies the key before it reads the body. A 401 uses none of the rate limit and none of the monthly quota.

Replace a keyCopy Anchor Link

When an Owner deletes a key, requests with that key get 401 within 1 minute. To replace a key without failed requests, follow these steps.

1. Create a new key.
2. Deploy the new key to every server that uses the old key.
3. Delete the old key on the API keys page.

All keys of a workspace share one rate limit and one monthly quota. Rate limits and quota explains both.