Skip to main content

API Key Management

The application key used to authenticate Re:port Flow API calls (a string starting with ak_) lives in the admin console under Workspace Settings → API Keys. Keys are issued per workspace, and when you authenticate with the API-key method each request carries it in the appkey header (OAuth 2.0 clients send a Bearer token instead). This page covers how to obtain one and how to store and rotate it safely.

Where do I get an API key?​

It is already there: open Workspace Settings → API Keys in the admin console. An application key is generated automatically when the workspace is created, so there is nothing to request or apply for.

1. Create a Workspace​

Log in to the Re:port Flow admin panel (https://re-port-flow.com) and create a new workspace.

The application key is generated automatically when the workspace is created.

2. Check API Integration Information​

Open the workspace details screen → "API Keys" tab to see the following:

  • API URL: https://api.re-port-flow.com/ (copy button available)
  • Application Key: ak_xxxxxxxxxxxxxxxx (copy button available)

Click the copy button on the right side of each item to copy the value to the clipboard.

info

One application key per workspace

Each workspace is bound to a single application key. The key can be regenerated periodically.

Managing API Keys​

Inspecting the key​

You can check the current application key information from the "API Keys" tab on the workspace details screen:

  • API URL: https://api.re-port-flow.com/ (copyable)
  • Application Key: ak_xxxxxxxxxxxxxxxx (copyable)
  • Last Rotation Date: 2024-02-14

Security Recommendations​

Manage with environment variables​

Recommended: keep the API key in environment variables, never hard-coded in source.

# .env file
REPORT_FLOW_APP_KEY=ak_xxxxxxxxxxxxxxxx
// Usage
const appKey = process.env.REPORT_FLOW_APP_KEY;

Add to .gitignore​

# Exclude files containing API keys from Git
.env
.env.local
.env.production
secrets.json

Rotate periodically​

For improved security, we recommend regenerating the application key every 3 months.

tip

A warning is shown in the "API Keys" section of the workspace details screen if more than 90 days have passed since the last rotation.

UI rotation steps:

  1. Open the workspace details screen → "API Keys" tab
  2. Click "Regenerate Application Key"
  3. Confirm in the modal
  4. Copy the displayed new key and apply it in your application
  5. Verify the application still works

API rotation:

curl -X POST \
  https://api.re-port-flow.com/v1/workspace/{workspaceId}/application-token/regenerate \
  -H 'Authorization: Bearer {access_token}' \
  -H 'Content-Type: application/json'

Response example:

{
  "applicationKey": "ak_xxxxxxxxxxxxxxxx",
  "lastRotatedAt": "2024-02-14T10:30:00.000Z"
}
warning

When the application key is regenerated, the old key is invalidated immediately. To avoid downtime, propagate the new key to your application configuration as quickly as possible.

Security​

Re:port Flow API keys are managed with industry-standard security measures:

  • Application keys are stored encrypted
  • All API operations are recorded in audit logs
  • Only HTTPS communication is supported; plain text is rejected
tip

For maximum security we recommend periodic key rotation (every 3 months).

Production security requirements​

For HTTPS / TLS version requirements, see Authentication overview.

Other best practices​

Storing the API key​

  • Keep it in environment variables, never hard-coded
  • Add .env to .gitignore
  • Prefer a secret manager (AWS Secrets Manager, etc.)

Access control​

  • Issue API keys only to the workspaces that actually need them
  • Regenerate keys immediately when no longer needed
  • Audit access logs periodically

For limits and quotas, see the Limitations page.

Troubleshooting​

Regenerating the application key​

The application key is visible in the "API Keys" tab of the admin panel. If it's not visible, issue a new key as follows:

  1. Open the workspace details screen → "API Keys" tab
  2. Click "Regenerate Application Key"
  3. Confirm the regeneration in the modal
  4. Copy the displayed new key
  5. Update your application configuration with the new key

When the key isn't working​

Most failures come down to the header name's casing, or a key that was copied with missing characters or stray whitespace. Work down the checklist below.

Check the following:

  • The appkey header is set correctly
  • The application key has been copied without truncation
  • The key is active (verify in the admin panel)
  • The header name is appkey (lowercase)

Next steps​