> ## Documentation Index
> Fetch the complete documentation index at: https://visaflo.ca/knowledge-base/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, protect, and send a VisaFlo workspace API key.

## API Keys

An administrator creates API keys from **Settings** > **API Settings** in VisaFlo. Give each key a clear integration name, such as `HubSpot production` or `Intake webhook`.

The key belongs to the workspace where it was created. VisaFlo uses it to determine which leads, clients, cases, files, tasks, notes, and workflows the request can access.

## Send the Key

Send the key on every workspace API request using `X-API-Key`.

```bash theme={null}
curl "https://api.visaflo.app/api/public/workflow/list" \
  -H "X-API-Key: YOUR_API_KEY"
```

Do not use `Authorization: Bearer` for this API. Bearer tokens are used by other VisaFlo product surfaces and do not authenticate workspace API requests.

## Keep Keys Safe

* Store keys in a secret manager or encrypted environment variable.
* Do not put a key in browser code, a client-side extension, or a public repository.
* Use one key per integration and environment.
* Revoke a key immediately when an integration is retired or a key may have leaked.

## Errors

| Status | Meaning                                                 | What to do                                                                    |
| ------ | ------------------------------------------------------- | ----------------------------------------------------------------------------- |
| `401`  | Missing, invalid, inactive, or expired API key          | Check the `X-API-Key` header, then generate or reactivate a key if necessary. |
| `400`  | Invalid request body or missing required input          | Correct the request using the endpoint reference.                             |
| `404`  | The requested record is not available in this workspace | Confirm the VisaFlo ID and that the record belongs to the key's workspace.    |
| `429`  | Rate limit reached                                      | Back off and retry with exponential delay.                                    |

<Warning>
  VisaFlo only displays a newly generated key once. Save it before closing the confirmation dialog.
</Warning>