← All support articles

Admin

Use the Flo API

Flo is API-first: almost everything you can do in the web app is available through public HTTP APIs. Use the in-app API reference for endpoints, request formats, and authentication details.

Prerequisites

  • Developer permission in your Flo organization (not assigned to every user by default)
  • A Flo account with access to Settings

How to use

1. Open the API settings

  1. Go to Settings → API (/settings/api).
  2. If you do not see this page, ask an org admin to grant you the developer role.

2. Browse the API reference

  1. Open the API reference tab.
  2. Browse operations, request bodies, and response schemas in the interactive OpenAPI docs.
  3. Download the OpenAPI spec from the reference if you need it for code generation or offline review.

The reference covers public routes on the Flo API gateway. Internal-only billing or operations routes are not included.

3. Authenticate your requests

Flo supports two credential types. Use one per request, not both.

Credential Header Best for
Cognito user session Authorization: Bearer <JWT> Web app, human-driven scripts, OAuth flows
API key x-api-key: flo_test_… or flo_live_… Integrations, CI, server-to-server automation

API keys authorize as a tenant service account (api_client). They do not impersonate the user who created the key.

4. Create and manage API keys

  1. Open the API keys tab.
  2. Click Create key, enter a name, and choose test or live prefix.
  3. Copy the secret immediately. Flo shows it only once.
  4. Revoke keys when rotating credentials or decommissioning an integration.

Send the key on every request:

x-api-key: flo_test_your_key_here

5. Connect AI tooling (optional)

The Claude plugin tab provides bootstrap configuration for Claude Code or Claude Desktop MCP against your tenant.

What the API covers

Public APIs support common platform operations such as:

  • Asset search, metadata, and delivery
  • Workflow and pipeline orchestration
  • Connector configuration (where your role allows)

Exact operations, parameters, and response shapes are in the API reference tab. Start there before building an integration.

Troubleshooting

  • 401 Unauthorized. Key missing, expired, or revoked; or the route requires a human JWT (for example /me) instead of an API key.
  • 403 Forbidden. Authenticated but your role cannot access admin routes (users, groups, roles).
  • Cannot see Settings → API. Ask an org admin for the developer permission.
  • Need integration help. Email contact@flomenco.com with your use case and the API operations you plan to call.