Authentication
Two ways in, each with a job:
| Method | Use for | Notes |
|---|---|---|
Authorization: Bearer | Data endpoints | Stripe-style fl_live_… keys, shown once at creation. Per-key rate limits: 600 req/min, 50k/day. |
| Session cookie | Dashboard & key management | HttpOnly, HMAC-signed. Key routes are session-only — a bearer token can't mint or revoke keys. |
Precedence rules
- An invalid or revoked bearer token returns 403 even with a valid session.
- An empty or malformed bearer token returns 401.
- Deactivated users can't log in or use keys.