Authentication

Creating an API key

1. 1. Sign in to your workspace at sopflow.io.
2. 2. Go to Settings → API Keys.
3. 3. Click Create API key, give it a name, and save.
4. 4. Copy the key — it is only shown once. Store it in a secret manager or environment variable.

API key creation requires the Pro plan or higher.

Sending the token

Include the key in every request's Authorization header:

curl https://sopflow.io/api/v1/organization \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

Scopes

Each key carries one or more scopes. read covers every GET; write is required for POST / PATCH / DELETE. Pick scopes when you create the key in Settings → API keys — scopes are stamped onto the key and can't be widened later. A 403 with insufficient_scope means the key isn't allowed to perform this action.

Reusable helper

A thin wrapper keeps auth logic in one place across your codebase:

// Reusable helper for all endpoints
async function sopflow(path, opts = {}) {
  const KEY = process.env.SOPFLOW_API_KEY; // store in env, never in source
  const res = await fetch(`https://sopflow.io/api/v1${path}`, {
    ...opts,
    headers: {
      Authorization: `Bearer ${KEY}`,
      "Content-Type": "application/json",
      ...opts.headers,
    },
  });
  const body = await res.json();
  if (!res.ok) throw new Error(body.error ?? "API error");
  return body.data;
}

// Usage
const org   = await sopflow("/organization");
const nodes = await sopflow("/nodes?limit=50");

Security best practices

• Never commit keys to source control. Use environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler).
• Never log the key value. Log the key name or ID instead. If a key appears in a log, rotate it immediately.
• Rotate regularly. Go to Settings → API Keys, create a new key, update your integration, then revoke the old one.
• Use HTTPS only. HTTP requests are rejected at the transport layer.