Skip to main content

Authentication Overview

Re:port Flow API supports two authentication methods: appkey header authentication and OAuth 2.0 / OpenID Connect. Choose the one that fits your use case.

Should I use appkey or OAuth?​

If you are automating a single workspace of your own, the appkey header is enough. Reach for OAuth 2.0 when an external service or another user has to authorise access. When in doubt, find the closest row in the "Use case" column below.

Use caseRecommended method
Single-workspace automation (cURL, internal batch jobs)appkey header
Server-to-server integration (backend → Re:port Flow)OAuth 2.0 Client Credentials
Per-user authorization (Make.com, third-party SaaS, personal apps)OAuth 2.0 Authorization Code + PKCE

See OAuth 2.0 Authentication for the OAuth flows. This page covers the appkey method.

appkey method​

Send the appkey header (lowercase) on every request:

appkey: your-application-key

API endpoint​

Base URL: https://api.re-port-flow.com/v1

Examples:

  • Single PDF generation: https://api.re-port-flow.com/v1/file/sync/single
  • Template parameters: https://api.re-port-flow.com/v1/file/design/parameter/{designId}

What do the authentication errors mean?​

appkey authentication fails with one of two status codes. A 412 means the appkey header was not sent at all (or its value is malformed); a 401 means it is well-formed but the value is wrong. Check which one you got before digging further. (OAuth 2.0 failures come back as RFC 6749 codes such as invalid_client instead — see Error responses.)

If authentication fails, the following errors are returned:

401 Unauthorized​

{
  "statusCode": 401,
  "code": "INVALID_CREDENTIALS",
  "message": "Invalid API key or access token.",
  "error": "Unauthorized",
  "details": [],
  "docsUrl": "https://doc.re-port-flow.com/en/docs/guides/error-codes#invalid_credentials"
}

Cause:

  • The appkey header is invalid or has been revoked

412 Precondition Failed​

{
  "statusCode": 412,
  "code": "AUTH_HEADER_MISSING",
  "message": "Authentication header is missing. Send an `appkey` header or `Authorization: Bearer <token>`.",
  "error": "Precondition Failed",
  "details": [],
  "docsUrl": "https://doc.re-port-flow.com/en/docs/guides/error-codes#auth_header_missing"
}

Cause:

  • The appkey header is missing or malformed

Security Best Practices​

1. Secure API Key Storage​

// ❌ Bad: Hardcoded in source code
const APP_KEY = 'hardcoded-key';

// ✅ Good: Use environment variables
const APP_KEY = process.env.REPORT_FLOW_APP_KEY;

2. Use HTTPS​

All API requests must use HTTPS. HTTP requests are not accepted.

3. Key Rotation​

Regularly regenerate API keys and invalidate old keys.

4. Scope Limitation​

Use different API keys for production and development environments to separate access.

Sample Code​

cURL​

curl -X POST https://api.re-port-flow.com/v1/file/sync/single \
  -H "appkey: your-application-key" \
  -H "Content-Type: application/json" \
  -d '{...}'

JavaScript​

const headers = {
  'appkey': process.env.REPORT_FLOW_APP_KEY,
  'Content-Type': 'application/json'
};

Python​

import os

headers = {
    'appkey': os.environ['REPORT_FLOW_APP_KEY'],
    'Content-Type': 'application/json'
}

OAuth 2.0 Authentication​

For server-to-server integrations or per-user authorization, use OAuth 2.0 instead of appkey.

  • Authorization Code + PKCE: User authorization flow for Make.com, custom apps, etc.
  • Client Credentials: Server-to-server integration from your backend to Re:port Flow

See OAuth 2.0 Authentication for details.

Next Steps​