Authentication

All API requests require a Bearer token. Create and manage API keys in the dashboard.

Bearer token authentication

All AlertFlow API requests are authenticated with a Bearer token in the Authorization header:

curl https://app.yourdomain.com/api/v1/alerts \
  -H "Authorization: Bearer af_live_your_key_here"

Creating an API key

1. 1
   Open API Keys

   Go to Settings → API Keys and click New API Key.

2. 2
   Name and scope it

   • Name: a descriptive label, e.g., "Monitoring Script" or "Grafana Integration"
   • Scopes: choose the minimum permissions needed (see table below)
   • Expiry: optional — set an expiry date for keys used by short-lived scripts
3. 3
   Copy the key

   After clicking Create, copy the full key value. It's shown only once. AlertFlow stores only a hash — the plaintext cannot be retrieved later.

API key scopes

Scopes follow the pattern resource:action. Grant only what the consumer needs.

Key format

AlertFlow API keys have the prefix af_live_ (production) or af_test_ (test environment). Example:

af_live_a1b2c3d4e5f6789012345678901234567890abcd

Revoking a key

1. Go to Settings → API Keys.
2. Click the ... menu next to the key.
3. Click Revoke.

Revocation is immediate — in-flight requests using that key will fail with 401.

Security best practices

• Store API keys in environment variables, never in source code
• Use the minimum scopes needed for each integration
• Set expiry dates for keys used by scripts or CI pipelines
• Rotate keys periodically — revoke and recreate
• Monitor key usage in Settings → Audit Log (filter by api_key.used)

Errors