Authentication

Flux uses API keys to authenticate requests. You can view and manage your API keys in the dashboard.

API Key Types

Type	Prefix	Use Case
Live	`sk_live_`	Production environment
Test	`sk_test_`	Development and testing

Test keys only work with test data and don’t trigger real webhooks or affect production resources.

Include your API key in the Authorization header:

curl https://api.flux.dev/v1/events \
  -H "Authorization: Bearer sk_live_your_api_key"

Or use the SDK, which handles authentication automatically:

const flux = new Flux('sk_live_your_api_key');

Keep your API keys secure. Never commit them to version control or expose them in client-side code.

We recommend storing your API key in an environment variable:

# .env
FLUX_API_KEY=sk_live_your_api_key

import Flux from '@flux/node';
const flux = new Flux(process.env.FLUX_API_KEY);

# .env
FLUX_API_KEY=sk_live_your_api_key

import os
from flux import Flux

flux = Flux(os.environ["FLUX_API_KEY"])

To rotate an API key:

Create a new key before deleting the old one to avoid downtime.

Enterprise plans support scoped API keys with limited permissions:

const scopedKey = await flux.apiKeys.create({
  name: 'Analytics Service',
  scopes: ['events:read'],
  expiresAt: '2025-01-01T00:00:00Z'
});

Available scopes:

API requests are rate limited based on your plan:

When rate limited, you’ll receive a 429 response with a Retry-After header.