Skip to main content
The FloKit v1 REST API is in design-partner preview. It is not yet served on a public host — endpoints, schemas, and the base URL may all change before general availability. The pages in this group describe the intended shape, not something you can call today. Contact your FloKit team for access.Endpoints that are live in production are documented under Live endpoints: the Paywall API and Entitlements API on https://payments-gateway.flokitai.com, and Measurement ingest on https://ingest.flokitai.com.
Base URL: not yet assigned. Your FloKit team gives you the preview host when you get access. All API requests require an API key passed as a Bearer token in the Authorization header.
Example:

​
API keys

Keys are workspace-scoped. Find existing keys or create new ones in FloKit → Settings → API Keys.

​
Key types

Use read-only keys for reporting pipelines and dashboards. Use read-write keys only in trusted server-side contexts.

​
Error responses

401 Unauthorized — API key is missing or invalid.
403 Forbidden — API key is valid but lacks the required permission for the operation (e.g. a read-only key attempting to send events).

​
Security

  • Store API keys in environment variables or a secrets manager (AWS Secrets Manager, GCP Secret Manager, Doppler, etc.).
  • Never commit API keys to version control.
  • Rotate keys in FloKit → Settings → API Keys. After rotation, the previous key is immediately invalidated.
  • Use separate keys per environment (production vs. staging) to prevent test traffic from entering production data.