Authentication and Tenants

Send your key in the X-API-Key header on every request. Each key is bound to one tenant, and a request that names another tenant is refused.

The key

Every request carries your key in the X-API-Key header. Keys are issued by TrackFlo, one per tenant and per system (your TMS integration gets one; a Front workspace gets its own). The plaintext is shown once at issuance and is not recoverable: if it is lost or leaks, ask TrackFlo to deactivate it and issue a new one. Deactivation takes effect within 60 seconds.

Missing or unknown key → 401 {"error": "Unauthorized"}.

Tenants

A key is bound to exactly one tenant, identified by its company_permalink (your slug, e.g. acme). Every request is checked against that tenant:

• company_permalink in the body must equal the key's tenant.

• Every *_permalink in the body or URL must end in -<company_permalink>.

A request that names another tenant → 403 {"error": "Forbidden"}. Nothing is written.

Rotation

Ask TrackFlo for a second key, switch your service to it, then have the first one deactivated. Two active keys per name is the supported rotation path.