Before you begin
- REST API access requires Pro (basic) or Enterprise (full) — see /docs/settings/plans-and-limits/
- Tenant admins create and revoke API tokens
- All requests must use HTTPS to app.flowforce.app
Auth model
- Workspace-scoped tokens — one tenant per key
- Send Authorization: Bearer <token> on every request
- Least-privilege scopes when creating keys (read vs write per resource)
- Rotate keys every 90 days; revoke immediately if leaked
Make a request
List leads
curl -sS -H "Authorization: Bearer $FLOWFORCE_API_KEY" \
"https://app.flowforce.app/api/v1/leads?limit=50"Response conventions
- 200 — success with JSON body
- 401 — missing or invalid token
- 403 — token lacks scope or plan gate
- 429 — rate limit exceeded; retry with backoff
- Use cursor or offset pagination as documented per endpoint
Rate limits
- Limits apply per workspace token
- Burst traffic should use exponential backoff on 429
- Bulk operations — prefer batch endpoints when available
- Enterprise may request higher limits — contact sales
Security
- Never commit tokens to git or expose in client-side code
- Store in secrets manager (Vault, AWS Secrets Manager, etc.)
- Offboard: rotate tokens when staff with key access leaves — /docs/account-and-team/manage-membership/
Common issues
- 401 Unauthorized — token revoked or wrong Bearer prefix
- 403 on Free plan — upgrade to Pro for API access
- Empty list — confirm tenant has data and token workspace matches