Authentication
Authenticate server integrations with scoped FluxDigest API keys.
FluxDigest accepts API keys in the Authorization header:
Authorization: Bearer fd_test_...Test keys start with fd_test_; production keys start with fd_live_. A key is
bound to one workspace and cannot access resources in another workspace, even
if an identifier is known.
Key lifecycle
Only workspace Owners and Admins can create keys. When creating one, provide:
- a name that identifies the integration;
- the minimum required scopes;
- test or live mode;
- an optional expiration date.
The full secret is displayed once. FluxDigest stores a verification digest, the non-secret prefix, and the final four characters. Rotate keys by creating a replacement, deploying it, confirming usage, and then revoking the old key.
Scopes
Scopes use a resource:action form. Read and write access are separate, and
sending is intentionally separate from editing campaigns.
| Scope | Allows |
|---|---|
workspaces:read | List and retrieve accessible workspace information |
subscribers:read | Read subscribers and subscriber activity |
subscribers:write | Create, import, update, and remove subscribers |
newsletters:read | Read newsletters |
newsletters:write | Create and update newsletters and send tests |
campaigns:read | Read campaigns and delivery summaries |
campaigns:write | Create, update, schedule, and archive campaigns |
campaigns:send | Start a production campaign send |
analytics:read | Read workspace and campaign analytics |
webhooks:write | Create, rotate, and disable webhook endpoints |
Secret handling
Never expose server keys
Do not use a secret API key in browser JavaScript, mobile application code, URLs, screenshots, support messages, or source control.
Load keys from a server-side secret manager. The TypeScript SDK rejects secret keys in browser environments. OAuth access tokens will support third-party and browser-mediated applications in a later release.