Skip to content
FLASHAPIDOCS
⌘

Authentication

Customer programs authenticate to api.flashapi.io with a FlashAPI API key. Public routes are API-versioned, not prefixed with a platform /v1:

Terminal window
curl https://api.flashapi.io/youtube/v1/video-details \
  -H 'X-FlashAPI-Key: fapi_example_not_a_real_secret'

The example value is not a real secret. Send the key only in X-FlashAPI-Key. Leave Authorization for the upstream API. GET /whoami returns the authenticated account; GET /health stays unauthenticated.

Dashboard users sign in with email OTP. Do not send dashboard cookies to the public gateway. Revocation can take about a minute to reach every location because the gateway reads a Workers KV projection, not D1.