Authentication - VisaFlo

API Keys

An administrator creates API keys from Settings > API Settings in VisaFlo. Give each key a clear integration name, such as HubSpot production or Intake webhook. The key belongs to the workspace where it was created. VisaFlo uses it to determine which leads, clients, cases, files, tasks, notes, and workflows the request can access.

Send the Key

Send the key on every workspace API request using X-API-Key.

curl "https://api.visaflo.app/api/public/workflow/list" \
  -H "X-API-Key: YOUR_API_KEY"

Do not use Authorization: Bearer for this API. Bearer tokens are used by other VisaFlo product surfaces and do not authenticate workspace API requests.

Keep Keys Safe

Store keys in a secret manager or encrypted environment variable.
Do not put a key in browser code, a client-side extension, or a public repository.
Use one key per integration and environment.
Revoke a key immediately when an integration is retired or a key may have leaked.

Errors

Status	Meaning	What to do
`401`	Missing, invalid, inactive, or expired API key	Check the `X-API-Key` header, then generate or reactivate a key if necessary.
`400`	Invalid request body or missing required input	Correct the request using the endpoint reference.
`404`	The requested record is not available in this workspace	Confirm the VisaFlo ID and that the record belongs to the key’s workspace.
`429`	Rate limit reached	Back off and retry with exponential delay.

VisaFlo only displays a newly generated key once. Save it before closing the confirmation dialog.

Quickstart Errors and retries

⌘I

​API Keys

​Send the Key

​Keep Keys Safe

​Errors

API Keys

Send the Key

Keep Keys Safe

Errors