API Keys

API keys authenticate requests from your systems to the FlowAlert event ingestion endpoint.

Creating a key

Go to Dashboard → Setup → API Keys and click Create API key. Give it a descriptive name (e.g. "WordPress Production", "Booking System").

⚠️

The full API key is only shown once at creation time. Copy it immediately and store it securely (e.g. in your server's environment variables). It cannot be retrieved again.

Using a key

Pass the key in the X-Api-Key header on every event request:

curl -X POST https://api.flowalert.io/v1/events \
  -H "X-Api-Key: fa_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "event": "order.created", "title": "New Order", "priority": "NORMAL" }'

Security best practices

Never expose your API key client-side (browser JavaScript, mobile apps). Keys should only be used server-side.
Use one key per integration — if a key is compromised, you can revoke it without affecting other integrations.
Rotate keys periodically — create a new key, update your integration, then delete the old key.

Revoking a key

Go to Dashboard → Setup → API Keys and click the delete icon next to a key. Deletion is immediate — any requests using that key will fail instantly.

Heartbeats WordPress Plugin